3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4

Sharing

Copy URL Twitter E-mail

General

Target
3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4
Size 1.4MB
Sample260804-k2mpssweka
SHA256 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4
MD5 be56f81aac89f1f901a9af59013d61f9
SHA1 4a637d4ed32f753d0c4b024b3f60e34d5310d280
SHA512 da608fd0c0b183be55ab1d833565a9401b312eca2d567bd269f46b86d72036fcc552525017194ff0469c3a64c4b221c6fe560bbd42638259a0950e8300439178
SSDEEP 12288:6DvmwGwFFYEhJhcPQAr2pFFPclVl+owFFYEhJhcPQAr2pFf3fKf:6DvowFmuShGPcdwFmuShi3fKf
TLSH
T17C65B45E3E8A72D9DC2FB03FCB11B5629633686802D15A4BE1957D1D0B4A084FFB9393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4

File Explorer

3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4

.exe 1.4MB

3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4

IMPHASH a398da80d29813096b7a8394b7495ffc
SHA256 3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4
MD5 be56f81aac89f1f901a9af59013d61f9
SHA1 4a637d4ed32f753d0c4b024b3f60e34d5310d280
SHA512 da608fd0c0b183be55ab1d833565a9401b312eca2d567bd269f46b86d72036fcc552525017194ff0469c3a64c4b221c6fe560bbd42638259a0950e8300439178
SSDEEP 12288:6DvmwGwFFYEhJhcPQAr2pFFPclVl+owFFYEhJhcPQAr2pFf3fKf:6DvowFmuShGPcdwFmuShi3fKf
TLSH
T17C65B45E3E8A72D9DC2FB03FCB11B5629633686802D15A4BE1957D1D0B4A084FFB9393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCloneImage GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipCreateHICONFromBitmap GdipFree GdipBitmapGetPixel GdipGetImageWidth GdipCreateBitmapFromFile

user32

EndPaint GetMessageW DefWindowProcW PostMessageW DestroyWindow GetDC SetWindowPos MessageBoxW FillRect CreateWindowExW SendMessageW GetSystemMetrics CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow DispatchMessageW SetTimer DestroyMenu TranslateMessage LoadCursorW SetCapture wsprintfW AppendMenuW UpdateLayeredWindow KillTimer PostQuitMessage UpdateWindow ReleaseCapture SetForegroundWindow ReleaseDC GetCursorPos BeginPaint

gdi32

CreateDIBSection CreateCompatibleDC DeleteDC DeleteObject CreateSolidBrush CreateEllipticRgn FillRgn SelectObject

kernel32

LoadLibraryExW VirtualProtect GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW WriteConsoleW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FlushFileBuffers HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetProcAddress LCMapStringW GetProcessHeap HeapSize GetCommandLineA HeapReAlloc CreateDirectoryW WriteFile GetModuleFileNameW GetTempPathW CreateFileW GetFileAttributesW QueryPerformanceFrequency GlobalAlloc DeleteFileW CloseHandle GlobalLock GetTempFileNameW QueryPerformanceCounter GlobalUnlock GetModuleHandleExW GetConsoleOutputCP GetConsoleMode SetFilePointerEx HeapFree FreeLibrary TerminateProcess ExitProcess GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlPcToFileHeader GetStdHandle GetCurrentProcess

advapi32

RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey

shell32

Shell_NotifyIconW SHGetFolderPathW

ole32

CreateStreamOnHGlobal

Name

.text

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

295KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3162dd66e99834d7f5aa33aa80c94d828707c8a121b0aeb79966b61f7eaa9aa4

gdiplus

user32

gdi32

kernel32

advapi32

shell32

ole32

generic