4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982

General

Target
4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982
Size 263KB
Sample260730-s5pybscn2t
SHA256 4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982
MD5 4d62f906de7885bee798e50732ae597c
SHA1 2c1577df69087b42177184639c1f655415eafc26
SHA512 c77c44bf6d853837fe32a24b3be85d35992c4eeff0ea980d08acf9ca2f1bde2fa81cd4021fdbbd2a2e0a4cecd9084aa703a033b9bc53e2561010f50447b44ff9
SSDEEP 6144:tN/rskL/JPl7BvQXTY7JPLE3dnvSadJsGmBj92wP67gAdkL:tN/fPl7Bmy5o3dl3RQ2wi7gAs
TLSH
T1F044BE68B7A90CFADDA7927DC9514206E7B27C460360EBDF07A44B252F232D05D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982

File Explorer

4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982

.exe 263KB

4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982

IMPHASH 132e3521f838d4fa70f0617911938bb2
SHA256 4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982
MD5 4d62f906de7885bee798e50732ae597c
SHA1 2c1577df69087b42177184639c1f655415eafc26
SHA512 c77c44bf6d853837fe32a24b3be85d35992c4eeff0ea980d08acf9ca2f1bde2fa81cd4021fdbbd2a2e0a4cecd9084aa703a033b9bc53e2561010f50447b44ff9
SSDEEP 6144:tN/rskL/JPl7BvQXTY7JPLE3dnvSadJsGmBj92wP67gAdkL:tN/fPl7Bmy5o3dl3RQ2wi7gAs
TLSH
T1F044BE68B7A90CFADDA7927DC9514206E7B27C460360EBDF07A44B252F232D05D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

23004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ChangeServiceConfig2A CloseServiceHandle ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA QueryServiceStatus RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA StartServiceA

kernel32

CloseHandle GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent WaitForSingleObject CreateEventA Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessA GetLocalTime VirtualFree GetModuleFileNameA LocalFree FormatMessageA lstrcmpiA lstrcpynA lstrcatA SetConsoleCtrlHandler VirtualAlloc GetModuleHandleA GetProcAddress LoadLibraryA MapViewOfFile UnmapViewOfFile CreateFileMappingA OpenFileMappingA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW SetEndOfFile RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx ReadFile ReadConsoleW CreateFileW GetFileSizeEx HeapSize HeapReAlloc WriteConsoleW

Name

.text

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4f3ed563acff1c2fbbb79babe119111f604eb3814e39fb100fd14a12ac4a7982

advapi32

kernel32

generic