220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9

Sharing

Copy URL Twitter E-mail

General

Target
220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9
Size 332KB
Sample260803-tb6jnavsft
SHA256 220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9
MD5 a70d6d416656a9e7d187b0782fb8ea10
SHA1 f9d07fe6fdf15a3647f141affd0bfa8f3d14b8e0
SHA512 299fc028dac23373b3feb1a783554ccbf851c5d719be09c0693922faa64422c522048203c82207be594f697baf209a3887b4a057370210b5dc8a7abf203e12e8
SSDEEP 3072:F7BsS3lLyONgeYLccI64UlYuvCm6wwhMdwuNdpf7VRRUUj:dBsSRyQIcY3doMWIZ7f
TLSH
T13E749E33B5D0C4F2D12222321DE14B39BAFCEA311DA246239794EFBA7E355528B1F156
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9

File Explorer

220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9

.exe 332KB

220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9

IMPHASH 31d38f2fb2db3b56f0ac35f76dd714ac
SHA256 220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9
MD5 a70d6d416656a9e7d187b0782fb8ea10
SHA1 f9d07fe6fdf15a3647f141affd0bfa8f3d14b8e0
SHA512 299fc028dac23373b3feb1a783554ccbf851c5d719be09c0693922faa64422c522048203c82207be594f697baf209a3887b4a057370210b5dc8a7abf203e12e8
SSDEEP 3072:F7BsS3lLyONgeYLccI64UlYuvCm6wwhMdwuNdpf7VRRUUj:dBsSRyQIcY3doMWIZ7f
TLSH
T13E749E33B5D0C4F2D12222321DE14B39BAFCEA311DA246239794EFBA7E355528B1F156
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LCMapStringA LoadLibraryA GetProcAddress FreeLibrary GetCommandLineA GetStartupInfoA CreateProcessA WaitForSingleObject WritePrivateProfileStringA CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom GlobalAlloc GlobalLock LocalAlloc TlsAlloc GlobalFree GlobalUnlock GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue lstrcpynA GetEnvironmentVariableA GlobalFlags InterlockedDecrement lstrcatA lstrcpyA InterlockedIncrement SetLastError GetLastError GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetVersion GetProcessVersion SetErrorMode SetFilePointer FlushFileBuffers GetCPInfo GetOEMCP RtlUnwind RaiseException HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter LCMapStringW GetStringTypeA GetStringTypeW IsBadCodePtr SetStdHandle GetPrivateProfileStringA WriteFile GetLocalTime CreateFileA GetFileSize ReadFile GetModuleFileNameA GetCommandLineW LocalFree IsBadReadPtr HeapFree HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap Process32Next Process32First TerminateProcess QueryDosDeviceW OpenProcess GetCurrentProcess GetTempPathW Module32First CreateToolhelp32Snapshot GetTimeFormatA GetDateFormatA GetLocaleInfoA FindClose FindFirstFileW GetCurrentProcessId WideCharToMultiByte lstrlenW MultiByteToWideChar lstrcpyn CloseHandle SetWaitableTimer lstrlenA CreateWaitableTimerA

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA RegOpenKeyExA

comctl32

ord17

gdi32

SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox DeleteObject SetBkColor SelectObject RestoreDC SaveDC DeleteDC CreateBitmap Escape ExtTextOutA TextOutA RectVisible PtVisible GetObjectA GetStockObject GetDeviceCaps

oleaut32

VariantTimeToSystemTime

psapi

EnumProcesses GetProcessImageFileNameW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

shlwapi

PathFindFileNameA PathFindExtensionA

user32

GetDlgItem SetWindowLongA SetWindowPos ShowWindow SetFocus GetSystemMetrics GetWindowPlacement IsIconic SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow GetClientRect AdjustWindowRectEx DrawTextA GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush LoadStringA DestroyMenu GetMenuItemCount UnhookWindowsHookEx GetWindowTextA SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible GetCursorPos SetWindowsHookExA GetParent GetLastActivePopup IsWindowEnabled GetWindowLongA EnableWindow SetCursor SendMessageA PostMessageA PostQuitMessage CopyRect GrayStringA TabbedTextOutA ReleaseDC GetDC PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA SendMessageTimeoutA GetClassNameA GetWindowThreadProcessId EnumWindows PostMessageW GetWindowTextW GetWindowTextLengthW MsgWaitForMultipleObjects FindWindowExA UnregisterClassA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

Sharing

General

Malware Config

Signatures

File Explorer

220e1e2a015b29513c4e89470254beb8313acd1ec8c42d378e659b45dd33bcc9

kernel32

advapi32

comctl32

gdi32

oleaut32

psapi

shell32

shlwapi

user32

winspool.drv

generic