5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995

Sharing

Copy URL Twitter E-mail

General

Target
5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995
Size 3.5MB
Sample260730-ll4h2sfb79
SHA256 5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995
MD5 00dafa7dd5774899683f10132daf9cb4
SHA1 3c8b6d7275c0ef04d0407d78a74f814fbe70cae5
SHA512 3b2fe6043142dd19277831e6c1d18e902caee05e19187db57992eaa9bbd29dd9c2dd47638f77e406351b5ad3ec8c3a589e557945fbc7945470505fad0454d281
SSDEEP 49152:DdbmF7UFH8uNH2m6pE0oyakfvEET651RX3ZKsBxkFU6vwasPpAYSIa:BbsUFH8uNr0XaQvw1j9gxwLxAYSIa
TLSH
T108065C4359DB0DE9CDD66BB4A1D31336A734FD748F291E3A6A08C2315D236C4AE2BB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995

File Explorer

5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995

.exe 3.5MB

5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995

IMPHASH 75a4ca768c30169f7c5ceb29d506e56e
SHA256 5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995
MD5 00dafa7dd5774899683f10132daf9cb4
SHA1 3c8b6d7275c0ef04d0407d78a74f814fbe70cae5
SHA512 3b2fe6043142dd19277831e6c1d18e902caee05e19187db57992eaa9bbd29dd9c2dd47638f77e406351b5ad3ec8c3a589e557945fbc7945470505fad0454d281
SSDEEP 49152:DdbmF7UFH8uNH2m6pE0oyakfvEET651RX3ZKsBxkFU6vwasPpAYSIa:BbsUFH8uNr0XaQvw1j9gxwLxAYSIa
TLSH
T108065C4359DB0DE9CDD66BB4A1D31336A734FD748F291E3A6A08C2315D236C4AE2BB50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken

kernel32

CloseHandle CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FormatMessageA GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetThreadId GetTickCount InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess Process32FirstW Process32NextW RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAllocEx VirtualProtect VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler lstrcmpW

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _onexit _vsnwprintf _wcmdln _wcsicmp abort calloc exit fprintf fputc fputs free fwrite getenv iswctype localeconv malloc memchr memcmp memcpy memmove memset realloc setlocale signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscat_s wcscoll wcscpy_s wcsftime wcslen wcsxfrm _read

ntdll

NtQueryInformationProcess NtQueryObject RtlAdjustPrivilege RtlNtStatusToDosError ZwSetIoCompletion

ole32

CoGetObject CoInitializeEx CoUninitialize

user32

GetSystemMetrics

Name

.text

Size

778KB

Virtual Size

778KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

978B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5e7c2784a7c607f8962cf3a9b4cbd0cb490b23d408ae03e0045b4eaf4b2bc995

advapi32

kernel32

msvcrt

ntdll

ole32

user32

generic