5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79

Sharing

Copy URL Twitter E-mail

General

Target
5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79
Size 270KB
Sample260804-lym2tsxcka
SHA256 5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79
MD5 2ff478c8356cbde77a954df43b0c612f
SHA1 68ff1e93e582c5590ba7c800c057f1f61033d467
SHA512 b24fa5cf25a25a412a5f3cd031d12bc04b9d042ba29b86b6063131658495e5e18c34d24442e7245ccc7cbc1a8558d366f7fe7ad3626699aaff045f84f03f65ad
SSDEEP 3072:oUUuaBmj3ecAq/L4rNjGnfgmNeTsRFA0te5dt2LPrYID/rniy7sCr2z:oUUuOmjOcA8cjGfgiMsRq0teH1qR
TLSH
T11F44C313A6CC7CE2C036463033BB87E5DB2EED604B91C58F96D406A59A3C5937532BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79

File Explorer

5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79

.exe 270KB

5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79

IMPHASH bbaf8a939acc2e4a21da9c2c1aeb36b9
SHA256 5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79
MD5 2ff478c8356cbde77a954df43b0c612f
SHA1 68ff1e93e582c5590ba7c800c057f1f61033d467
SHA512 b24fa5cf25a25a412a5f3cd031d12bc04b9d042ba29b86b6063131658495e5e18c34d24442e7245ccc7cbc1a8558d366f7fe7ad3626699aaff045f84f03f65ad
SSDEEP 3072:oUUuaBmj3ecAq/L4rNjGnfgmNeTsRFA0te5dt2LPrYID/rniy7sCr2z:oUUuOmjOcA8cjGfgiMsRq0teH1qR
TLSH
T11F44C313A6CC7CE2C036463033BB87E5DB2EED604B91C58F96D406A59A3C5937532BE9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW PathIsRootW PathFileExistsW SHDeleteKeyW

advapi32

RegCloseKey RegSetValueExW RegGetValueW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegCreateKeyExW

shell32

SHGetFolderPathW SHChangeNotify CommandLineToArgvW

ole32

CoInitialize CoUninitialize

comctl32

InitCommonControlsEx

user32

MessageBoxW PostMessageW DefWindowProcW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreateFileW GetFileType WriteFile GetStdHandle DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime WriteConsoleW GetModuleFileNameW QueryFullProcessImageNameW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree GetModuleHandleExW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess

Sharing

General

Malware Config

Signatures

File Explorer

5eb5e343a916ccc3905ab3dff545510bf560fcb9a138950db0d0d0274bbbdf79

version

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

generic