cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6

Sharing

Copy URL Twitter E-mail

General

Target
cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6
Size 274KB
Sample260804-rgddysca33
SHA256 cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6
MD5 54482166e2035b227a81296b86bc1df1
SHA1 58a9ed0b00a5813a7d4ef9102058a89e7ef76480
SHA512 a1059dbc6bce23a6ab40543552fd4d4cfef576369ba4bf1b5608bb9db96054b26c3bcfb5c7bc65ea792510b8e0b106a9ba893ca45480f4f07f4146417f0fc352
SSDEEP 6144:XWUv6zAMlSPwKNlJu3Vd9gR4WHqAv5m8Et:XWUslSPwKD0Fd9Yth
TLSH
T16254D413A6DC7CE2C036463033BB87E5D72EED604B91C58F96C406A99A3C5937532BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6

File Explorer

cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6

.exe 274KB

cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6

IMPHASH 8a001a60edc492f3384a4556acb713ff
SHA256 cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6
MD5 54482166e2035b227a81296b86bc1df1
SHA1 58a9ed0b00a5813a7d4ef9102058a89e7ef76480
SHA512 a1059dbc6bce23a6ab40543552fd4d4cfef576369ba4bf1b5608bb9db96054b26c3bcfb5c7bc65ea792510b8e0b106a9ba893ca45480f4f07f4146417f0fc352
SSDEEP 6144:XWUv6zAMlSPwKNlJu3Vd9gR4WHqAv5m8Et:XWUslSPwKD0Fd9Yth
TLSH
T16254D413A6DC7CE2C036463033BB87E5D72EED604B91C58F96C406A99A3C5937532BE9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts

shlwapi

PathIsDirectoryW SHDeleteKeyW PathFindFileNameW PathFileExistsW PathAppendW PathRemoveFileSpecW PathIsRootW

advapi32

RegCloseKey RegSetValueExW RegGetValueW RegCreateKeyExW

shell32

SHGetFolderPathW SHChangeNotify CommandLineToArgvW ShellExecuteW SHCreateDirectoryExW

ole32

CoInitialize CoUninitialize

comctl32

InitCommonControlsEx

user32

MessageBoxW PostMessageW DefWindowProcW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreateFileW GetModuleFileNameW GetFileType WriteFile GetStdHandle DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount WriteConsoleW QueryFullProcessImageNameW CopyFileW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree GetModuleHandleExW ExitProcess LoadLibraryExW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress

Sharing

General

Malware Config

Signatures

File Explorer

cefc2ac1190b3554670485dc70d0858b1cec487ba22a04f69518732cd63bcaf6

winhttp

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

generic