8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806

Sharing

Copy URL Twitter E-mail

General

Target
8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806
Size 291KB
Sample260804-t5ps1avend
SHA256 8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806
MD5 238504f9ae9aeb968505eb7a248fcd09
SHA1 15b60aa6a02b9527f44fd49ef574ff2dad347ce3
SHA512 56671df49d0aa1d73b2c9a693f16b5ead002985617427fab3f68d9d1177fc4a3413bf650a38d27e1a1961ae75ef115a2fecadad5bbc1a3cc0610d4ea3494a66a
SSDEEP 6144:0n4fRw5Up0rjmrdYGmteyAOfGutaRTzG:U4ujmBbydXtaRS
TLSH
T1AA549C2171D5C0B3D17285320D79EAA6653CBC300B2196EF93D86E2EDE345C1AA36B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806

File Explorer

8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806

.exe 291KB

8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806

IMPHASH 6662cd38fc966a3e79812bc2ee126490
SHA256 8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806
MD5 238504f9ae9aeb968505eb7a248fcd09
SHA1 15b60aa6a02b9527f44fd49ef574ff2dad347ce3
SHA512 56671df49d0aa1d73b2c9a693f16b5ead002985617427fab3f68d9d1177fc4a3413bf650a38d27e1a1961ae75ef115a2fecadad5bbc1a3cc0610d4ea3494a66a
SSDEEP 6144:0n4fRw5Up0rjmrdYGmteyAOfGutaRTzG:U4ujmBbydXtaRS
TLSH
T1AA549C2171D5C0B3D17285320D79EAA6653CBC300B2196EF93D86E2EDE345C1AA36B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

Shell_NotifyIconW ShellExecuteExW

comctl32

InitCommonControlsEx

ws2_32

WSAStartup gethostname gethostbyname inet_ntoa WSACleanup

shlwapi

PathFileExistsW

kernel32

GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW CopyFileW MultiByteToWideChar WideCharToMultiByte GetFileAttributesW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW DeleteFileW RemoveDirectoryW GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter SetStdHandle TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapSize GetFileType GetACP WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess HeapReAlloc HeapFree HeapAlloc LoadLibraryExW FreeLibrary GetLastError RtlUnwind RaiseException GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW GetCurrentProcess CreateFileW

user32

LoadIconW LoadCursorW GetClassNameW SetWindowLongW GetWindowLongW PtInRect FillRect MapWindowPoints ClientToScreen GetCursorPos SetCursor AdjustWindowRect GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyIcon UpdateWindow DrawTextW AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics EnableWindow GetDlgCtrlID ShowWindow DestroyWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW TrackMouseEvent MessageBoxW DispatchMessageW TranslateMessage GetMessageW SetForegroundWindow TrackPopupMenu

gdi32

DeleteObject CreateFontW CreateSolidBrush SelectObject SetBkColor SetBkMode SetTextColor EnumFontFamiliesExW GetStockObject

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8da494079960c74e6d55212938050299948ff8f86d347f34de7b05556e3bc806

shell32

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

generic