0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f

Sharing

Copy URL Twitter E-mail

General

Target
0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f
Size 1.1MB
Sample260729-fxd5msveme
SHA256 0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f
MD5 d1d4d1460e0f3ab0d518e40bae34b29c
SHA1 d4f23db969eb956f72737b1c3e35490e006c2c73
SHA512 832a1b9373d93c90e1141d7a2ec6b64b4278d68cdc238959f7b267c089422a3b3108360e29a5999a3dc54f8acbf1a4c744bf3e691698e8f65b79507367681fad
SSDEEP 12288:7z32xQ/4vBx5A3KFau/z32xAKsqt26IfEbS/Kyi9Lf5:wNs3+auUAAt26IfEbS/Kyi9j5
TLSH
T10045D610F3E515A2E5B34B3458BEE3392B3CBA529236CB1F9744C92D0D637D25DA1B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f

File Explorer

0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f

.dll 1.1MB

0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f

IMPHASH 4586dfb1ab1cc6d9c861b21d4d982e1b
SHA256 0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f
MD5 d1d4d1460e0f3ab0d518e40bae34b29c
SHA1 d4f23db969eb956f72737b1c3e35490e006c2c73
SHA512 832a1b9373d93c90e1141d7a2ec6b64b4278d68cdc238959f7b267c089422a3b3108360e29a5999a3dc54f8acbf1a4c744bf3e691698e8f65b79507367681fad
SSDEEP 12288:7z32xQ/4vBx5A3KFau/z32xAKsqt26IfEbS/Kyi9Lf5:wNs3+auUAAt26IfEbS/Kyi9j5
TLSH
T10045D610F3E515A2E5B34B3458BEE3392B3CBA529236CB1F9744C92D0D637D25DA1B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BMAPIAddress BMAPIDetails BMAPIFindNext BMAPIGetAddress BMAPIGetReadMail BMAPIReadMail BMAPIResolveName BMAPISaveMail BMAPISendMail BuildDisplayTable@40 CbOfEncoded@4 CchOfEncoding@4 ChangeIdleRoutine@28 CloseIMsgSession@4 CreateIProp@24 CreateTable@36 DeinitMapiUtil@0 DeregisterIdleRoutine@4 DllCanUnloadNow DllGetClassObject EnableIdleRoutine@8 EncodeID@12 FBadColumnSet@4 FBadEntryList@4 FBadProp@4 FBadPropTag@4 FBadRestriction@4 FBadRglpNameID@8 FBadRglpszA@8 FBadRglpszW@8 FBadRow@4 FBadRowSet@4 FBadSortOrderSet@4 FBinFromHex@8 FDecodeID@12 FEqualNames@8 FGetComponentPath FGetComponentPath@20 FPropCompareProp@12 FPropContainsProp@12 FPropExists@8 FixMAPI FixMAPI@0 FreePadrlist@4 FreeProws@4 FtAdcFt@20 FtAddFt@16 FtDivFtBogus@20 FtMulDw@12 FtMulDwDw@8 FtNegFt@8 FtSubFt@16 FtgRegisterIdleRoutine@20 GetAttribIMsgOnIStg@12 GetOutlookVersion GetOutlookVersion@0 GetTnefStreamCodepage GetTnefStreamCodepage@12 HexFromBin@12 HrAddColumns@16 HrAddColumnsEx@20 HrAllocAdviseSink@12 HrComposeEID@28 HrComposeMsgID@24 HrDecomposeEID@28 HrDecomposeMsgID@24 HrDispatchNotifications@4 HrEntryIDFromSz@12 HrGetOmiProvidersFlags HrGetOmiProvidersFlags@8 HrGetOneProp@12 HrIStorageFromStream@16 HrQueryAllRows@24 HrSetOmiProvidersFlagsInvalid HrSetOmiProvidersFlagsInvalid@4 HrSetOneProp@8 HrSzFromEntryID@12 HrThisThreadAdviseSink@8 HrValidateIPMSubtree@20 HrValidateParameters@8 InstallFilterHook@4 IsBadBoundedStringPtr@8 LAUNCHWIZARD LPropCompareProp@8 LaunchWizard@20 LpValFindProp@12 MAPIAddress MAPIAdminProfiles MAPIAdminProfiles@8 MAPIAllocateBuffer MAPIAllocateBuffer@8 MAPIAllocateMore MAPIAllocateMore@12 MAPIDeinitIdle@0 MAPIDeleteMail MAPIDetails MAPIFindNext MAPIFreeBuffer MAPIFreeBuffer@4 MAPIGetDefaultMalloc@0 MAPIInitIdle@4 MAPIInitialize MAPIInitialize@4 MAPILogoff MAPILogon MAPILogonEx MAPILogonEx@20 MAPIOpenFormMgr MAPIOpenFormMgr@8 MAPIOpenLocalFormContainer MAPIOpenLocalFormContainer@4 MAPIReadMail MAPIResolveName MAPISaveMail MAPISendDocuments MAPISendMail MAPISendMailW MAPIUninitialize MAPIUninitialize@0 MNLS_CompareStringW@24 MNLS_IsBadStringPtrW@8 MNLS_MultiByteToWideChar@24 MNLS_WideCharToMultiByte@32 MNLS_lstrcmpW@8 MNLS_lstrcpyW@8 MNLS_lstrlenW@4 MapStorageSCode@4 OpenIMsgOnIStg@44 OpenIMsgSession@12 OpenStreamOnFile OpenStreamOnFile@24 OpenTnefStream OpenTnefStream@28 OpenTnefStreamEx OpenTnefStreamEx@32 PRProviderInit PpropFindProp@12 PropCopyMore@16 RTFSync RTFSync@12 ScBinFromHexBounded@12 ScCopyNotifications@16 ScCopyProps@16 ScCountNotifications@12 ScCountProps@12 ScCreateConversationIndex@16 ScDupPropset@16 ScGenerateMuid@4 ScInitMapiUtil@4 ScLocalPathFromUNC@12 ScMAPIXFromCMC ScMAPIXFromSMAPI ScRelocNotifications@20 ScRelocProps@20 ScUNCFromLocalPath@12 SetAttribIMsgOnIStg@16 SwapPlong@8 SwapPword@8 SzFindCh@8 SzFindLastCh@8 SzFindSz@8 UFromSz@4 UNKOBJ_COFree@8 UNKOBJ_Free@8 UNKOBJ_FreeRows@8 UNKOBJ_ScAllocate@12 UNKOBJ_ScAllocateMore@16 UNKOBJ_ScCOAllocate@12 UNKOBJ_ScCOReallocate@12 UNKOBJ_ScSzFromIdsAlloc@20 UlAddRef@4 UlFromSzHex@4 UlPropSize@4 UlRelease@4 WrapCompressedRTFStream WrapCompressedRTFStream@12 WrapProgress@20 WrapStoreEntryID@24 __CPPValidateParameters@8 __ValidateParameters@8 cmc_act_on cmc_free cmc_list cmc_logoff cmc_logon cmc_look_up cmc_query_configuration cmc_read cmc_send cmc_send_documents

Name

.text

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

60KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

320B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

138B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

0d2e3986c47d4ef201e1ae2ea41f53c8792212d91d18986ef48b8488737dc63f

advapi32

kernel32

ntdll

shlwapi

ucrtbase

user32

generic