af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114

Sharing

Copy URL Twitter E-mail

General

Target
af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114
Size 14.5MB
Sample260804-2v2c2ssdmf
SHA256 af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114
MD5 132406eebf1574c622b9e190550d0512
SHA1 98a3f833937f8af0673dd52ae6d6b0fcc2d520e5
SHA512 e28b4ce49880b84adf70a8eed04c54d3be0a5d7a537c1ae852ce527b48f2a0054bba2198cab003e09427a4594b279aa9e602c0842bae34e6b5a5519d7bb00dca
SSDEEP 196608:cke+dSLHmIwt4Z48a0k95SBfprfYScjHv0Q5MECiSZHHUkN9SWiYS:cPoLt2Kmprw9jTPgSWq
TLSH
T192E6239B2CCB44EAD5C108F0931B67E727F3919A4BC94C3A6AC53445B4B1FFA603E592
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114

File Explorer

af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114

.dll 14.5MB

af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114

IMPHASH 5884a9cd3f2377c2fb0b9ef952d313f9
SHA256 af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114
MD5 132406eebf1574c622b9e190550d0512
SHA1 98a3f833937f8af0673dd52ae6d6b0fcc2d520e5
SHA512 e28b4ce49880b84adf70a8eed04c54d3be0a5d7a537c1ae852ce527b48f2a0054bba2198cab003e09427a4594b279aa9e602c0842bae34e6b5a5519d7bb00dca
SSDEEP 196608:cke+dSLHmIwt4Z48a0k95SBfprfYScjHv0Q5MECiSZHHUkN9SWiYS:cPoLt2Kmprw9jTPgSWq
TLSH
T192E6239B2CCB44EAD5C108F0931B67E727F3919A4BC94C3A6AC53445B4B1FFA603E592
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11215482

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ComCopyFile ComCreateAutoPool ComCreateFolder ComDeleteAutoPool ComDeleteFile ComDeleteFiles ComDeleteFolder ComFileAttribute ComFileExist ComGetBytesPerLineForBW ComGetBytesPerLineForColor24 ComGetBytesPerLineForColor48 ComGetBytesPerLineForGray16 ComGetBytesPerLineForGray8 ComGetCaddisLibraryPath ComGetProcAddress ComGetTempPath ComLoadLibrary ComMacOrNot ComMcharToWchar ComMemcpy ComMoveFile ComPthreadCancel ComPthreadCondDestroy ComPthreadCondInit ComPthreadCreate ComPthreadEndWithTimeout ComPthreadMutexDestroy ComPthreadMutexInit ComPthreadMutexLock ComPthreadMutexUnlock ComPthreadSetFirst ComPthreadSetLast ComPthreadTestcancel ComScanUtility1Exist ComSleep ComSprintf ComStrTok ComStrcat ComStrcmp ComStrcpy ComStrlen ComStrncpy ComTWAINExist ComUnloadLibrary ComVsprintf ComWAddSlash ComWSprintf ComWStrMacth ComWStrStr ComWStrcat ComWStrcmp ComWStrcpy ComWStrlen ComWStrncpy ComWcharToMchar ComWinOrNot DELETE_CMFILE_CLASS DELETE_CMLOCK_CLASS DELETE_CMSTR_CLASS DELETE_SM_IMAGE_INFO DELETE_SM_OPTION_INFO DELETE_SM_SCAN_PARAM DELETE_SM_XFORM_INFO DebugLogInitialize DebugLogMessageOut DebugLogStringOut DebugLogTerminate NEW_CMFILE_CLASS NEW_CMLOCK_CLASS NEW_CMSTR_CLASS NEW_CMSTR_CLASS_CLONE NEW_CMSTR_CLASS_LEN NEW_CMSTR_CLASS_STR_LEN NEW_CMSTR_CLASS_WSTR_LEN NEW_SM_IMAGE_INFO NEW_SM_IMAGE_INFO_CLONE NEW_SM_IMAGE_INFO_PARAM NEW_SM_OPTION_INFO NEW_SM_OPTION_INFO_CLONE NEW_SM_SCAN_PARAM NEW_SM_SCAN_PARAM_CLONE NEW_SM_XFORM_INFO NEW_SM_XFORM_INFO_CLONE _DELETE_EncryptPassword@4 _NEW_EncryptPassword@4 _SUCheckCryptProtectMemory@0

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.2AX

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.afQ

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.76*

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

908B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

af9f313b99cf6fb6d68ac77ca8ed2406252edef581dae478a76ad54ad3ad7114

kernel32

user32

advapi32

generic