8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1

General

Target
8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1
Size 245KB
Sample260802-frcdvsdd76
SHA256 8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1
MD5 34e690259d14e5028986b3c59cbb2bbb
SHA1 c1e46c664324789baabaf4abeef6900e9bf6222d
SHA512 f612760b2647fb481c1359edbc652483bab082e92e98ae889e94d898f04398c54d0fbe7bda8403d0bf94ee709ef2d39715eecc32668d2b732c07f871454de625
SSDEEP 3072:cEFJpeWtHgfgjPGXmzXEt10hCOOZRcsQZRJTurn0WFGpPJXe8whHPPiA7dyPObTj:cEFyGPQUdQLZD0WFQChQ2bTj
TLSH
T1E5348D1977A51CFAEEB7853DCD524506DA727C564BA0EACF03E00A964F23AD08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1

File Explorer

8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1

.exe 245KB

8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1

IMPHASH ea1815fd01e1f41b8c87f074f8256c02
SHA256 8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1
MD5 34e690259d14e5028986b3c59cbb2bbb
SHA1 c1e46c664324789baabaf4abeef6900e9bf6222d
SHA512 f612760b2647fb481c1359edbc652483bab082e92e98ae889e94d898f04398c54d0fbe7bda8403d0bf94ee709ef2d39715eecc32668d2b732c07f871454de625
SSDEEP 3072:cEFJpeWtHgfgjPGXmzXEt10hCOOZRcsQZRJTurn0WFGpPJXe8whHPPiA7dyPObTj:cEFyGPQUdQLZD0WFQChQ2bTj
TLSH
T1E5348D1977A51CFAEEB7853DCD524506DA727C564BA0EACF03E00A964F23AD08E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle WaitForSingleObject Sleep GetCurrentProcess GetModuleHandleA GetProcAddress LoadLibraryExA LoadLibraryA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8c5b084509975d1446a83ab5e615f21b56d4dfc60ae55a9eba6a68e1b061d3b1

kernel32

generic