4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e

General

Target
4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e
Size 698KB
Sample260731-gfdcfsdf36
SHA256 4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e
MD5 bbb609fc394a2fdcbecfe4d7e09f70fd
SHA1 673ab927fd809ea1e090ea97f2bd065e614b42e1
SHA512 8a4ed02b37252a5677d03c4ce9e39214217f604ab9362b5fa572d3fda28b0b4d58acffb1d7656f89421070fdeb76c39c113f7a2079f1e4868076987948772d9f
SSDEEP 12288:NnbDjNr92jIfUOIhrlt3AyHlWbTAEVT0ENwJTDV:Nn3jq8fUOIhrlt3AyHlWbTHVoENwVV
TLSH
T1C0E43959769441B5D13BD13DC6818A56EAB33C154F319ACF0399B3AA9F332E05F3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e

File Explorer

4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e

.exe 698KB

4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e

IMPHASH 4f3c23426f69c195d46b2d3a9afac448
SHA256 4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e
MD5 bbb609fc394a2fdcbecfe4d7e09f70fd
SHA1 673ab927fd809ea1e090ea97f2bd065e614b42e1
SHA512 8a4ed02b37252a5677d03c4ce9e39214217f604ab9362b5fa572d3fda28b0b4d58acffb1d7656f89421070fdeb76c39c113f7a2079f1e4868076987948772d9f
SSDEEP 12288:NnbDjNr92jIfUOIhrlt3AyHlWbTAEVT0ENwJTDV:Nn3jq8fUOIhrlt3AyHlWbTHVoENwVV
TLSH
T1C0E43959769441B5D13BD13DC6818A56EAB33C154F319ACF0399B3AA9F332E05F3A322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

135448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build@2\Rhino\Safe\Bin\Win32\release\pdb\2345ExtShell64.pdb

kernel32

ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW LoadLibraryA GetModuleHandleW LoadLibraryExW FindFirstFileW GetLongPathNameW GetShortPathNameW CreateFileW GetLastError GetFileAttributesExW SearchPathW lstrlenW GetVersionExW lstrcatW lstrcpyW lstrcmpiW ReadFile WriteFile SetFilePointer SetEndOfFile DeleteFileW CloseHandle GetFileSizeEx GetDriveTypeW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetFileTime GetFileSize GetFileTime CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW GetSystemDirectoryW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW SetCurrentDirectoryW MoveFileExW CopyFileW GetTempFileNameW MoveFileW FindNextFileW FindClose WaitForMultipleObjects WaitForSingleObject LocalFree GetCurrentProcessId CreateProcessW GetExitCodeProcess CreateMutexW ReleaseMutex Sleep OpenMutexW HeapFree GetCurrentThreadId GetComputerNameExW OpenProcess GlobalAlloc GlobalFree HeapAlloc GetProcessHeap LockResource GetSystemInfo LoadResource FindResourceW FreeLibrary QueryDosDeviceW GetCurrentProcess GetVolumeInformationW GetDiskFreeSpaceW GetLogicalDriveStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStdHandle GetEnvironmentVariableW GetFileType MultiByteToWideChar RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP SetConsoleCtrlHandler GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStringTypeW OutputDebugStringA OutputDebugStringW WaitForSingleObjectEx CreateThread FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW GetProcAddress FormatMessageW LoadLibraryW RtlUnwind

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

DeregisterEventSource ReportEventW RegisterEventSourceW

Name

.text

Size

430KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4ddf03d336885c0e599b5dcb17b2af0c27dc7ce0fef2f1446515c07f2922297e

kernel32

user32

advapi32

generic