b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863

General

Target
b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863
Size 412KB
Sample260804-24ntbaab38
SHA256 b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863
MD5 c5e1835bc5646ac86d74fb38a9d54de3
SHA1 c09369780f55913717b321f5f75e7ea3493e0d3e
SHA512 8c0efd525dd087b043b16fdc1ee23224eab661dab0f1b981611bd508bf17f3942930e518ff4bd9d344407f688be800419ca039c77facd6dcccccf9f78007b82a
SSDEEP 3072:53rWS7onfMJlpuDZC7g2encYmKngXcxH3rWS7onfMJlpuDZC7g2encI3rWS7onfP:JEnfMjpneREnfMjpnGEnfMjpn8
TLSH
T195949601BBE65021F5B71F781EBC98B6972E7EA29F7588DF0220D28D06735C198347B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863

File Explorer

b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863

.dll 412KB

b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863

IMPHASH df94e7c8995a1db2b713368622cf2c1f
SHA256 b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863
MD5 c5e1835bc5646ac86d74fb38a9d54de3
SHA1 c09369780f55913717b321f5f75e7ea3493e0d3e
SHA512 8c0efd525dd087b043b16fdc1ee23224eab661dab0f1b981611bd508bf17f3942930e518ff4bd9d344407f688be800419ca039c77facd6dcccccf9f78007b82a
SSDEEP 3072:53rWS7onfMJlpuDZC7g2encYmKngXcxH3rWS7onfMJlpuDZC7g2encI3rWS7onfP:JEnfMjpneREnfMjpnGEnfMjpn8
TLSH
T195949601BBE65021F5B71F781EBC98B6972E7EA29F7588DF0220D28D06735C198347B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

50912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

spoolss

EnumPortsW

user32

LoadStringW wsprintfW

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcpy memmove strchr strcmp strcpy strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

b1c4a126a3dfa5426fa84da54b40b9a78fe78956a869b6171a23235f28c14863

spoolss

user32

advapi32

ucrtbase

kernel32

ntdll

generic