3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527

Sharing

Copy URL Twitter E-mail

General

Target
3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527
Size 272KB
Sample260804-sswkca1va1
SHA256 3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527
MD5 0aa8a05dd50c9fa7a5fc6e424685a7c8
SHA1 9fa24e45bb2d6b42ff994d1f6058fd60ccb01a82
SHA512 1ebab5d7aeeab9c994e38721ccf14d7fef0a8da1de392aa07f3a919c2b4c943e29849b721ffdd51a4c09b0417047754fce4aa116ca5112973825c5483ba73b7f
SSDEEP 3072:avksW/1WwXcqEztxcvnvNW/mG4yLHFRjzo5gi/46+fIBVNrpTKfsCrGs:avksg1WzqEBkvY/djLHzjzo6nyPm
TLSH
T1E044C313A6CC7CE2C036563037BB87E5D72EED604B91C58F96C406A9CA3C5937522BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527

File Explorer

3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527

.exe 272KB

3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527

IMPHASH cf3646a830a293989daf9c2aca82ed43
SHA256 3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527
MD5 0aa8a05dd50c9fa7a5fc6e424685a7c8
SHA1 9fa24e45bb2d6b42ff994d1f6058fd60ccb01a82
SHA512 1ebab5d7aeeab9c994e38721ccf14d7fef0a8da1de392aa07f3a919c2b4c943e29849b721ffdd51a4c09b0417047754fce4aa116ca5112973825c5483ba73b7f
SSDEEP 3072:avksW/1WwXcqEztxcvnvNW/mG4yLHFRjzo5gi/46+fIBVNrpTKfsCrGs:avksg1WzqEBkvY/djLHzjzo6nyPm
TLSH
T1E044C313A6CC7CE2C036563037BB87E5D72EED604B91C58F96C406A9CA3C5937522BE9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW SHDeleteKeyW PathFindFileNameW PathFileExistsW PathAppendW PathRemoveFileSpecW PathIsRootW

advapi32

RegCloseKey RegSetValueExW RegGetValueW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegCreateKeyExW

shell32

SHGetFolderPathW SHChangeNotify CommandLineToArgvW ShellExecuteW SHCreateDirectoryExW

ole32

CoInitialize CoUninitialize

comctl32

InitCommonControlsEx

user32

MessageBoxW PostMessageW DefWindowProcW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreateFileW GetModuleFileNameW GetFileType WriteFile GetStdHandle GetModuleHandleExW DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount WriteConsoleW QueryFullProcessImageNameW CopyFileW MoveFileExW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree ExitProcess LoadLibraryExW GetProcAddress IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary

Sharing

General

Malware Config

Signatures

File Explorer

3b9ebee6329e6d4c38119bc19247979b7cc78e8fc688f9cbfb3a286e8f761527

version

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

generic