efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be

Sharing

Copy URL Twitter E-mail

General

Target
efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be
Size 272KB
Sample260804-sveplshm41
SHA256 efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be
MD5 00b4c9de496390769308c6c9aef733a2
SHA1 f05dad1692d1a485bb40823d337a958ecc48e65a
SHA512 72ea795071370bcbd5f735ca499c490a25b0a6537d6e90c2694365f9049a43835241dc7dccad57e66ea1de50686b30051c7c60252b6498928a50dce9056a105d
SSDEEP 3072:oTTNeHe4FvIk8Va76RpBzUEC+2TgNyCjxG0XR5s/i/Yp+fI2bPrpzyfsCrdI:oTTNIe46PVcMwA2UMCjg0XRCfKNGc
TLSH
T14044D413A6CC7CE2C036563037BB87E1D72EED604B91C58F96C406A9DA3C5937522BE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be

File Explorer

efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be

.exe 272KB

efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be

IMPHASH 1175acdfbf3ea59c05f32d47877c9bc0
SHA256 efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be
MD5 00b4c9de496390769308c6c9aef733a2
SHA1 f05dad1692d1a485bb40823d337a958ecc48e65a
SHA512 72ea795071370bcbd5f735ca499c490a25b0a6537d6e90c2694365f9049a43835241dc7dccad57e66ea1de50686b30051c7c60252b6498928a50dce9056a105d
SSDEEP 3072:oTTNeHe4FvIk8Va76RpBzUEC+2TgNyCjxG0XR5s/i/Yp+fI2bPrpzyfsCrdI:oTTNIe46PVcMwA2UMCjg0XRCfKNGc
TLSH
T14044D413A6CC7CE2C036563037BB87E1D72EED604B91C58F96C406A9DA3C5937522BE9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33935

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\WD\WD_Main\Release\Uninst.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW SHDeleteKeyW PathFindFileNameW PathFileExistsW PathAppendW PathRemoveFileSpecW PathIsRootW

advapi32

RegCloseKey RegSetValueExW RegGetValueW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegCreateKeyExW

shell32

SHGetFolderPathW SHChangeNotify CommandLineToArgvW ShellExecuteW SHCreateDirectoryExW

ole32

CoInitialize CoUninitialize

comctl32

InitCommonControlsEx

user32

MessageBoxW PostMessageW DefWindowProcW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CreateFileW GetModuleFileNameW GetFileType WriteFile GetStdHandle DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW CloseHandle GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount WriteConsoleW QueryFullProcessImageNameW CopyFileW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemDirectoryW LocalFree GetModuleHandleExW ExitProcess LoadLibraryExW IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress

Sharing

General

Malware Config

Signatures

File Explorer

efb56568b4c761797e64a900a727ade455844cf8d2c2a3197cacd92dbf5bb9be

version

shlwapi

advapi32

shell32

ole32

comctl32

user32

kernel32

generic