0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716

Sharing

Copy URL Twitter E-mail

General

Target
0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716
Size 656KB
Sample260729-fa7tfavale
SHA256 0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716
MD5 ce237875b4ce9315252d150f364955a8
SHA1 5d2427cf763376c3d03142b8db8afd8c77045c77
SHA512 b5fb5a14bfbb68bff3be5d53761914280c5647329740ee5733621084732b0a87a4303a743a455646de89d68454f0bb09a352cad5c51afb809a4958a27bb8e4bd
SSDEEP 6144:puuiQ+JWGGXAz2kp71vcFPR59ZnTFPkjA+NB:pBiPHGXk2T3Jp8jA+NB
TLSH
T180E4965033F49556F6F38B386CF6E2512A7A7E415B32CB0F8200592D0936BD2DEA5B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716

File Explorer

0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716

.dll 656KB

0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716

IMPHASH 31f896196702bd72474789f6e06d26c3
SHA256 0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716
MD5 ce237875b4ce9315252d150f364955a8
SHA1 5d2427cf763376c3d03142b8db8afd8c77045c77
SHA512 b5fb5a14bfbb68bff3be5d53761914280c5647329740ee5733621084732b0a87a4303a743a455646de89d68454f0bb09a352cad5c51afb809a4958a27bb8e4bd
SSDEEP 6144:puuiQ+JWGGXAz2kp71vcFPR59ZnTFPkjA+NB:pBiPHGXk2T3Jp8jA+NB
TLSH
T180E4965033F49556F6F38B386CF6E2512A7A7E415B32CB0F8200592D0936BD2DEA5B27
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW

bcrypt

BCryptHash

comctl32

ImageList_Create ImageList_Destroy ImageList_ReplaceIcon InitCommonControlsEx PropertySheetW

comdlg32

GetOpenFileNameW

kernel32

DelayLoadFailureHook GetTickCount HeapReAlloc IsBadStringPtrW ResolveDelayLoadedAPI

kernelbase

CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteFileW GetFileSize GetFinalPathNameByHandleW GetModuleHandleW GetProcAddress GetSystemDirectoryW HeapAlloc HeapFree LocalFree MapViewOfFile MultiByteToWideChar PathAllocCanonicalize UnmapViewOfFile

ntdll

_vsnprintf

ole32

CoTaskMemAlloc

shell32

ExtractIconExW ShellExecuteExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wgetenv calloc free fwrite getenv malloc memcmp memcpy memmove realloc strchr strcmp strcspn strlen wcschr wcscmp wcslen wcsncmp wcstol

urlmon

CreateAsyncBindCtx CreateURLMoniker

user32

DestroyIcon DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetDlgItem GetSystemMetrics GetWindowTextW LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW SendDlgItemMessageW SendMessageW SetWindowTextW ShowWindow TranslateMessage wsprintfW

Name

.text

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

264KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0b85080ac7cfb46fc7f4edbbe83239f2ca760a13d59d4fd405f931857a619716

advapi32

bcrypt

comctl32

comdlg32

kernel32

kernelbase

ntdll

ole32

shell32

ucrtbase

urlmon

user32

generic