85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74

Sharing

Copy URL Twitter E-mail

General

Target
85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74
Size 267KB
Sample260804-k187ea1zex
SHA256 85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74
MD5 ecfd80066217cf4d29b8ce15903f1181
SHA1 ee5eccdc71d66882d36d71c0d75a88cd1e56fb18
SHA512 05bb116f5be755bbff76b4cc7418ed22492d8f90296cb3da6c6539c73c48353fbadb90459b87da64c53de99f6f092cf74c96b7d9afef00e0d5315f065a69cd59
SSDEEP 3072:KAnZwePRumSqJhMDQgpDeRaG501bE5D7//4gVIjWJ3ykYCrOd:KAnme4xahbghOaGe1bEF7R
TLSH
T11044D3136ADC7CE2C036573037BB87E1DB2DED604A91C58F96C406A58A3C5937632BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74

File Explorer

85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74

.exe 267KB

85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74

IMPHASH 48829f5bfb0c1485679300fb50662314
SHA256 85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74
MD5 ecfd80066217cf4d29b8ce15903f1181
SHA1 ee5eccdc71d66882d36d71c0d75a88cd1e56fb18
SHA512 05bb116f5be755bbff76b4cc7418ed22492d8f90296cb3da6c6539c73c48353fbadb90459b87da64c53de99f6f092cf74c96b7d9afef00e0d5315f065a69cd59
SSDEEP 3072:KAnZwePRumSqJhMDQgpDeRaG501bE5D7//4gVIjWJ3ykYCrOd:KAnme4xahbghOaGe1bEF7R
TLSH
T11044D3136ADC7CE2C036573037BB87E1DB2DED604A91C58F96C406A58A3C5937632BE9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

shlwapi

PathIsDirectoryW SHDeleteKeyW PathFindFileNameW PathFileExistsW PathAppendW PathRemoveFileSpecW PathIsRootW

advapi32

RegCloseKey RegSetValueExW RegGetValueW RegCreateKeyExW

shell32

SHGetFolderPathW SHChangeNotify CommandLineToArgvW ShellExecuteW SHCreateDirectoryExW

ole32

CoInitialize CoUninitialize

comctl32

InitCommonControlsEx

user32

MessageBoxW PostMessageW DefWindowProcW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreateFileW GetModuleFileNameW GetFileType WriteFile GetStdHandle DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount WriteConsoleW QueryFullProcessImageNameW CopyFileW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree GetModuleHandleExW ExitProcess LoadLibraryExW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress

Sharing

General

Malware Config

Signatures

File Explorer

85b664ea672cad87a0db04d8e667b1321ea4e2e063c569bdd0233dd474c15e74

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

generic