1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92

Sharing

Copy URL Twitter E-mail

General

Target
1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92
Size 108KB
Sample260730-ntrwbshn21
SHA256 1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92
MD5 141d41ff9edda34385f7222286b5b571
SHA1 272500bc763d5b3dbe8f7e89a69fcba0e2751cce
SHA512 0db1c00d0e3a58f1cd29b96ccdc8ae0181851ab5d06bfc81975089b959670a4c11783d87ac0b2718aff927ec4f9b53f36b44d0d12b66d88a9c839f1dbf609e83
SSDEEP 1536:hPAdulv5SvWOcxFJRgwePMSTJ+JsFnKA3/oM3MqprT4c:hPAdnwxFJu5PoyFnKAPoerprMc
TLSH
T139B39C01B6E1C477D2DA413D59669B3AA7BBAE308EF14D436B643B4CAE31151CF2720E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92

File Explorer

1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92

.dll 108KB

1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92

IMPHASH a20eba799531002bdaa8778757efd95f
SHA256 1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92
MD5 141d41ff9edda34385f7222286b5b571
SHA1 272500bc763d5b3dbe8f7e89a69fcba0e2751cce
SHA512 0db1c00d0e3a58f1cd29b96ccdc8ae0181851ab5d06bfc81975089b959670a4c11783d87ac0b2718aff927ec4f9b53f36b44d0d12b66d88a9c839f1dbf609e83
SSDEEP 1536:hPAdulv5SvWOcxFJRgwePMSTJ+JsFnKA3/oM3MqprT4c:hPAdnwxFJu5PoyFnKAPoerprMc
TLSH
T139B39C01B6E1C477D2DA413D59669B3AA7BBAE308EF14D436B643B4CAE31151CF2720E
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34053

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MultiByteToWideChar lstrlenA FlushInstructionCache GetCurrentProcess InterlockedIncrement InterlockedDecrement DisableThreadLibraryCalls InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection IsBadWritePtr SetStdHandle LoadLibraryA GetProcAddress GetOEMCP GetACP IsBadCodePtr GetStringTypeW GetStringTypeA GetCPInfo SetUnhandledExceptionFilter FlushFileBuffers SetFilePointer lstrcpyA lstrlenW WideCharToMultiByte IsBadReadPtr DeviceIoControl CreateFileA GetLastError CloseHandle GetDiskFreeSpaceExA GetVolumeInformationA GetComputerNameA ReadFile GetVersionExA WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType Sleep InterlockedExchange RtlUnwind HeapReAlloc HeapAlloc HeapFree GetCommandLineA GetVersion RaiseException ExitProcess TerminateProcess HeapSize LCMapStringA LCMapStringW GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue VirtualFree VirtualAlloc GetModuleHandleA GetModuleFileNameA GetEnvironmentVariableA HeapDestroy HeapCreate SetHandleCount GetStdHandle

user32

CallWindowProcA GetWindowLongA SetWindowLongA SetRectEmpty ShowWindow DefWindowProcA DestroyWindow IsWindow PostMessageA MoveWindow CreateWindowExA SetFocus GetParent

ole32

CoCreateGuid CoTaskMemAlloc CoTaskMemFree StringFromCLSID

oleaut32

SysAllocString SysAllocStringLen SysStringLen SysFreeString

atl

ord18 ord15 ord16 ord21 ord23 ord32 ord43 ord44 ord46 ord31 ord30 ord57

ws2_32

inet_ntoa gethostbyname gethostname WSACleanup WSAStartup

netapi32

Netbios

Sharing

General

Malware Config

Signatures

File Explorer

1b970322336843fa1d8c76e42143f014a61e8eb546e88e74bf8365dace946e92

kernel32

user32

ole32

oleaut32

atl

ws2_32

netapi32

generic