0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f

Sharing

Copy URL Twitter E-mail

General

Target
0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f
Size 235KB
Sample260802-wtke9adh37
SHA256 0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f
MD5 afca0a41b41abb203917f52553229727
SHA1 b970d2cd335fd98c579f6345503451607aeed404
SHA512 74f99e05d5b7107ca70edf789396c894aa8bdf3eb55955e5df99005e796f37888b95d7a73e9b0cb8ca879509fdae4d4a1d1d3106fba0ef71bd18d333a7622f02
SSDEEP 3072:9rY7tHF0/nlLDHKy6Hnv5mYTVOC1vH+aAujCbd/hnybAuO1McGJqGFLfwBETKH:9rcHs96HvgYRZd+aAYCbllIwFILfGuw
TLSH
T16E343A2175918432E7650B3059E4EAF5992EBD754BA0E8CFE3943FBA48301C39A3771E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f

File Explorer

0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f

.exe 235KB

0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f

IMPHASH cf26a965393f0be5e60497bfa478e0e6
SHA256 0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f
MD5 afca0a41b41abb203917f52553229727
SHA1 b970d2cd335fd98c579f6345503451607aeed404
SHA512 74f99e05d5b7107ca70edf789396c894aa8bdf3eb55955e5df99005e796f37888b95d7a73e9b0cb8ca879509fdae4d4a1d1d3106fba0ef71bd18d333a7622f02
SSDEEP 3072:9rY7tHF0/nlLDHKy6Hnv5mYTVOC1vH+aAujCbd/hnybAuO1McGJqGFLfwBETKH:9rcHs96HvgYRZd+aAYCbllIwFILfGuw
TLSH
T16E343A2175918432E7650B3059E4EAF5992EBD754BA0E8CFE3943FBA48301C39A3771E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\code\weasel\output\WeaselSetup.pdb

kernel32

GetThreadUILanguage Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection SetEnvironmentVariableW WaitForSingleObject CloseHandle LoadLibraryW FreeLibrary GetFileAttributesW SizeofResource LockResource LoadResource FindResourceW FindResourceExW InitializeCriticalSectionEx DecodePointer DeleteCriticalSection RaiseException MultiByteToWideChar GetUserDefaultUILanguage lstrcmpiW LeaveCriticalSection EnterCriticalSection LoadLibraryExW GetCurrentThreadId SetThreadUILanguage SetThreadLocale Sleep GetExitCodeProcess SetLastError GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetSystemDirectoryW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetFilePointerEx GetStringTypeW LCMapStringW VirtualProtect FlsFree FlsSetValue GetModuleFileNameW GetCurrentProcess GetModuleHandleW GetProcAddress DeleteFileW MoveFileExW CopyFileW HeapDestroy GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize ExitProcess GetLastError GetSystemWow64DirectoryW FlsGetValue FlsAlloc GetFileType WriteFile GetStdHandle GetCPInfo GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue FreeEnvironmentStringsW ExpandEnvironmentStringsW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx WideCharToMultiByte QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW GetCurrentProcessId RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc WriteConsoleW

user32

CheckRadioButton GetDlgItem MessageBoxExW SetFocus SetWindowTextW EnableWindow DialogBoxParamW MessageBoxW LoadStringW GetActiveWindow DestroyWindow CharNextW SetWindowPos SetWindowLongW EndDialog UnregisterClassW GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints

advapi32

RegGetValueW RegQueryValueExW FreeSid CheckTokenMembership AllocateAndInitializeSid RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegDeleteKeyExW RegDeleteKeyW RegCloseKey

shell32

SHParseDisplayName SHCreateShellItem ShellExecuteW ShellExecuteExW

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitialize CoUninitialize

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Name

.text

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0be4d4216aae42b9327d3104a1c58ff79da06f5eee9aae3f58883a747041898f

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

generic