601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77

Sharing

Copy URL Twitter E-mail

General

Target
601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77
Size 387KB
Sample260804-lmbvesgh82
SHA256 601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77
MD5 0e064ea902166bfe639c73bc6d9afe2b
SHA1 83f22133d42fe4434ed7dbe14a27480eabc2df6c
SHA512 e5bc14a84c48524754972637cd04fbe1c4c262b84650fd9113b3cb2060a19209bebe3718981560ae2024664ee15d1eb140db8711b3bcbae9f357f2c41a6f9c83
SSDEEP 6144:P2zBXVSLVNDpLnMaRSokPjczLFIMq5v4cU4PR9NIvOS:P8wVdAjczxIBNi
TLSH
T1CC84D5136A9C7CE6C5710271273B8BEAD72DED600B91C5DF92C80A65D97C0C37631BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77

File Explorer

601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77

.exe 387KB

601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77

IMPHASH f179f06f04d218fd8a278219be9e8942
SHA256 601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77
MD5 0e064ea902166bfe639c73bc6d9afe2b
SHA1 83f22133d42fe4434ed7dbe14a27480eabc2df6c
SHA512 e5bc14a84c48524754972637cd04fbe1c4c262b84650fd9113b3cb2060a19209bebe3718981560ae2024664ee15d1eb140db8711b3bcbae9f357f2c41a6f9c83
SSDEEP 6144:P2zBXVSLVNDpLnMaRSokPjczLFIMq5v4cU4PR9NIvOS:P8wVdAjczxIBNi
TLSH
T1CC84D5136A9C7CE6C5710271273B8BEAD72DED600B91C5DF92C80A65D97C0C37631BAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW PathFindFileNameW PathFileExistsW PathAppendW SHDeleteKeyW PathIsRootW PathRemoveFileSpecW StrCmpNIW StrTrimA PathCombineW StrStrIA StrStrIW StrCmpIW

advapi32

RegEnumKeyExW RegOpenKeyExW GetTokenInformation OpenProcessToken RegQueryValueExW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetValueExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteW CommandLineToArgvW SHChangeNotify

ole32

CoUninitialize CoInitialize CoSetProxyBlanket CoCreateGuid CoInitializeEx CoInitializeSecurity CoCreateInstance

comctl32

InitCommonControlsEx

user32

PostMessageW DefWindowProcW MessageBoxW

kernel32

GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW SetEvent GetFileType WriteFile GetStdHandle GetModuleHandleExW ExitProcess WriteConsoleW LCMapStringW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc ResetEvent HeapFree GetLocaleInfoW GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount GetModuleFileNameW QueryFullProcessImageNameW CopyFileW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree TlsFree TlsSetValue TlsGetValue HeapSize IsValidLocale TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer SetLastError WaitForSingleObjectEx CreateEventW FormatMessageW HeapReAlloc SwitchToThread GetStringTypeW SetStdHandle FreeEnvironmentStringsW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitializeCriticalSection Sleep GetSystemWindowsDirectoryW GetVersionExW FreeLibrary FreeResource GetProcAddress LoadLibraryExW MultiByteToWideChar CreateFileW DeviceIoControl lstrcmpA RtlUnwind GetEnvironmentStringsW

oleaut32

VariantClear VariantInit SysAllocString SysStringLen SysFreeString

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

601de05430d34d7023a7556ae70e589b728e7c2c013ba912f919ed4eddb6ff77

version

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

oleaut32

iphlpapi

generic