7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc

Sharing

Copy URL Twitter E-mail

General

Target
7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc
Size 3.6MB
Sample260804-faegwsda67
SHA256 7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc
MD5 da6a114917bdb41286172fcaec6a05a3
SHA1 0d891499b453fec47129011c7160128223bbfabd
SHA512 f9ddb3d0c884f700a05a8f4b563ce62fed0ddc1616dca94b9dce075666491e0b3c32b666dbc35f96181e3fc124950452aef0d0cff20e4221fa99448841e49170
SSDEEP 49152:BCXlJCJAXzil2zD/8n9wQ9lfSiOeS+j8EG32sJsv6tWKFdu9CmPT/G7pzapHFhhU:2JUxEIsJsv6tWKFdu9Cm64w
TLSH
T197068D83B6B65365D9B7C13486E7952BD672BC428F2095DF115CB3192AB36F00E3B328
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc

File Explorer

7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc

.exe 3.6MB

7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc

IMPHASH 14c02962c51c65b6a72813cde9a5efb6
SHA256 7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc
MD5 da6a114917bdb41286172fcaec6a05a3
SHA1 0d891499b453fec47129011c7160128223bbfabd
SHA512 f9ddb3d0c884f700a05a8f4b563ce62fed0ddc1616dca94b9dce075666491e0b3c32b666dbc35f96181e3fc124950452aef0d0cff20e4221fa99448841e49170
SSDEEP 49152:BCXlJCJAXzil2zD/8n9wQ9lfSiOeS+j8EG32sJsv6tWKFdu9CmPT/G7pzapHFhhU:2JUxEIsJsv6tWKFdu9Cm64w
TLSH
T197068D83B6B65365D9B7C13486E7952BD672BC428F2095DF115CB3192AB36F00E3B328
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1504192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CancelIoEx CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateNamedPipeW CreateProcessW CreateThread CreateWaitableTimerExW DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrencyFormatW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoW GetLogicalDrives GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserGeoID GetUserPreferredUILanguages GetVolumeInformationW GetVolumeNameForVolumeMountPointW GetVolumePathNameW GetVolumePathNamesForVolumeNameW HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReadFileEx RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadPriority SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

ntdll

NtWriteFile RtlNtStatusToDosError

ole32

CoCreateInstance CoInitialize CoTaskMemFree CoUninitialize

advapi32

AccessCheck AllocateAndInitializeSid BuildTrusteeWithSidW CopySid DuplicateToken FreeSid GetEffectiveRightsFromAclW GetLengthSid GetNamedSecurityInfoW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation LookupAccountSidW MapGenericMask OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW SystemFunction036

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

mpr

WNetGetUniversalNameW

user32

CharNextExA CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnumWindows GetQueueStatus GetWindowLongPtrW GetWindowThreadProcessId KillTimer MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostThreadMessageW RegisterClassW SetTimer SetWindowLongPtrW TranslateMessage UnregisterClassW

netapi32

NetApiBufferFree NetShareEnum

userenv

GetUserProfileDirectoryW

winmm

timeKillEvent timeSetEvent

ws2_32

WSAAsyncSelect

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

117KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

113B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc

kernel32

ntdll

ole32

advapi32

version

mpr

user32

netapi32

userenv

winmm

ws2_32

generic