d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce

Sharing

Copy URL Twitter E-mail

General

Target
d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce
Size 387KB
Sample260804-ljerxasvgw
SHA256 d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce
MD5 b57fc4675df81824471909caaaec0b64
SHA1 7f093e1ec175aca89bfadae9076df87348c5f87b
SHA512 ee2643979b0cc99e5ae62a05c24b8bc4a001dd9db564a66e273b8ec56bd5028f477131be1d5569eb5f985c6b288465541bdce0427c684e7c475a5b24a8b74ce2
SSDEEP 6144:PnqIfZyELhcuHOoW/ZIrPHHzTjIMipHwch0CXzwqGub:Pl7LRrHHz3IJfF3
TLSH
T1D384D5136A9C7CE6C5710271273B8BEAD72DED600B91C5DF92C80A65D97C0C37631BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce

File Explorer

d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce

.exe 387KB

d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce

IMPHASH f179f06f04d218fd8a278219be9e8942
SHA256 d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce
MD5 b57fc4675df81824471909caaaec0b64
SHA1 7f093e1ec175aca89bfadae9076df87348c5f87b
SHA512 ee2643979b0cc99e5ae62a05c24b8bc4a001dd9db564a66e273b8ec56bd5028f477131be1d5569eb5f985c6b288465541bdce0427c684e7c475a5b24a8b74ce2
SSDEEP 6144:PnqIfZyELhcuHOoW/ZIrPHHzTjIMipHwch0CXzwqGub:Pl7LRrHHz3IJfF3
TLSH
T1D384D5136A9C7CE6C5710271273B8BEAD72DED600B91C5DF92C80A65D97C0C37631BAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35211

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW PathFindFileNameW PathFileExistsW PathAppendW SHDeleteKeyW PathIsRootW PathRemoveFileSpecW StrCmpNIW StrTrimA PathCombineW StrStrIA StrStrIW StrCmpIW

advapi32

RegEnumKeyExW RegOpenKeyExW GetTokenInformation OpenProcessToken RegQueryValueExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteW CommandLineToArgvW SHChangeNotify

ole32

CoUninitialize CoInitialize CoSetProxyBlanket CoCreateGuid CoInitializeEx CoInitializeSecurity CoCreateInstance

comctl32

InitCommonControlsEx

user32

PostMessageW DefWindowProcW MessageBoxW

kernel32

GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW SetEvent GetFileType WriteFile GetStdHandle GetModuleHandleExW ExitProcess WriteConsoleW LCMapStringW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc ResetEvent HeapFree GetLocaleInfoW GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount GetModuleFileNameW QueryFullProcessImageNameW CopyFileW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree TlsFree TlsSetValue TlsGetValue HeapSize IsValidLocale TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError WaitForSingleObjectEx CreateEventW FormatMessageW HeapReAlloc SwitchToThread GetStringTypeW SetStdHandle FreeEnvironmentStringsW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitializeCriticalSection Sleep GetSystemWindowsDirectoryW GetVersionExW FreeLibrary FreeResource GetProcAddress LoadLibraryExW MultiByteToWideChar CreateFileW DeviceIoControl lstrcmpA RtlUnwind GetEnvironmentStringsW

oleaut32

VariantClear VariantInit SysAllocString SysStringLen SysFreeString

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

d4e0a898fc822091993b6a75a95d381f392dd999dcef32ecf61d4acbf5b14cce

version

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

oleaut32

iphlpapi

generic