f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d

General

Target
f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d
Size 31KB
Sample260730-w92pgadg76
SHA256 f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d
MD5 dcd63c8cd987b8f83668e6f1eb92686c
SHA1 b3724061b660db02181b931b0a77adde10f028ff
SHA512 c9b7df0956890c8140c60c10ae987cb34903608effb8fcebe65f3bfa7463a70d98b78a186f82f64110c277e5a217e92b3be30ce6202ff2d35a896fecb3a16641
SSDEEP 768:l7uazfV9s8C1TwFVNm+WaGV4lH4fhHqZy:lRzfzRBJuExy
TLSH
T116E2F75D362254B9E20AC5F9C1D5C732DEB0BC221BB1872F4376B7361E229D21FB6641
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d

File Explorer

f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d

.exe 31KB

f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d

IMPHASH 4a78785934334b153e49abcf0bcbfe60
SHA256 f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d
MD5 dcd63c8cd987b8f83668e6f1eb92686c
SHA1 b3724061b660db02181b931b0a77adde10f028ff
SHA512 c9b7df0956890c8140c60c10ae987cb34903608effb8fcebe65f3bfa7463a70d98b78a186f82f64110c277e5a217e92b3be30ce6202ff2d35a896fecb3a16641
SSDEEP 768:l7uazfV9s8C1TwFVNm+WaGV4lH4fhHqZy:lRzfzRBJuExy
TLSH
T116E2F75D362254B9E20AC5F9C1D5C732DEB0BC221BB1872F4376B7361E229D21FB6641
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

6

Major OS version

6

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle ConvertDefaultLocale CreatePipe CreateProcessA DeleteCriticalSection EnterCriticalSection GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleFileNameA GetProcessHeap GetStartupInfoA GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection MultiByteToWideChar ReadFile SetCriticalSectionSpinCount SetHandleInformation SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _initterm _snprintf abort atexit calloc exit fflush fprintf free malloc memcpy memset rand setvbuf signal srand strlen strncmp vfprintf

user32

EnumWindows GetSystemMetrics GetWindowLongPtrW GetWindowTextA IsDialogMessageW IsWindowVisible MessageBoxA RegisterClassW SetWindowPos

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

Name

.text

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

676B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f0f6fcde504c59dfcd55807ca48448d3e6362bc082362b472effecd9a66c272d

kernel32

msvcrt

user32

winhttp

generic