4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385

General

Target
4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385
Size 424KB
Sample260804-2579cafp2t
SHA256 4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385
MD5 3a45a86e381bc2b5e6ac23490efaffb1
SHA1 4e6a3f7fc6528edec7e07de465462ccdd6f7b53e
SHA512 b85cc988f044a5d771d6ff9b91e526474e4859e409921124859a1cb951a7fe72bf3da69bb6bf90ee155b0dd2a6e1791a2a318b077dd074c953a7a75065ccdfe2
SSDEEP 3072:vfskaDhoKMa8/NHhxHcfskaDhoKMa8/NHhxHx50MBC2fskaDhoKMa8/NHhxHx50X:vfskaDJfskaDKfskaD
TLSH
T1569473111BED98F4E17A8FF505B79F921E7538030BE482DF1B64E90C2CB59D0AAB4396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385

File Explorer

4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385

.dll 424KB

4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385

IMPHASH 28d6a63be11028d6860294d33fb1dea9
SHA256 4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385
MD5 3a45a86e381bc2b5e6ac23490efaffb1
SHA1 4e6a3f7fc6528edec7e07de465462ccdd6f7b53e
SHA512 b85cc988f044a5d771d6ff9b91e526474e4859e409921124859a1cb951a7fe72bf3da69bb6bf90ee155b0dd2a6e1791a2a318b077dd074c953a7a75065ccdfe2
SSDEEP 3072:vfskaDhoKMa8/NHhxHcfskaDhoKMa8/NHhxHx50MBC2fskaDhoKMa8/NHhxHx50X:vfskaDJfskaDKfskaD
TLSH
T1569473111BED98F4E17A8FF505B79F921E7538030BE482DF1B64E90C2CB59D0AAB4396
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

18192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

comctl32

ord413 InitCommonControls ord412 ord410

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow

advapi32

CredEnumerateW CredFree CredWriteW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp free fwrite getenv memcpy memmove memset strchr strcmp strcpy strcspn strlen wcschr wcslen wcsrchr

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar RaiseException SizeofResource lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4f47c7d5edcd236e6db42dd40fe9d8a19464ef46b652e07f71526328e4d65385

comctl32

user32

advapi32

ucrtbase

kernel32

ntdll

generic