1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635

Sharing

Copy URL Twitter E-mail

General

Target
1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635
Size 1.7MB
Sample260804-thsldathkh
SHA256 1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635
MD5 3a0b3f4c7382944e598da48306b64dff
SHA1 2e2a5484f777d15ca18daf914291419bac858064
SHA512 6c40772b83cb84ee4b9262fcadd2c14d4944fa2630c774c223fd696a2b8a15d4564558595f1282cdb5e1e413d94bfa3fe60fbeb41c06642fbfdf359436a91221
SSDEEP 49152:eNv7cZrcRq01rHzNHFiNBxUSP5j21OyHbjS:ePFZ7
TLSH
T1C085091BB291C1D8C055D0F8C36E8E63DA72F8891674B0FA27C405B13EBBD66673DA64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635

File Explorer

1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635

.exe 1.7MB

1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635

IMPHASH 22975ac523236b539a2851d22b3a9b0b
SHA256 1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635
MD5 3a0b3f4c7382944e598da48306b64dff
SHA1 2e2a5484f777d15ca18daf914291419bac858064
SHA512 6c40772b83cb84ee4b9262fcadd2c14d4944fa2630c774c223fd696a2b8a15d4564558595f1282cdb5e1e413d94bfa3fe60fbeb41c06642fbfdf359436a91221
SSDEEP 49152:eNv7cZrcRq01rHzNHFiNBxUSP5j21OyHbjS:ePFZ7
TLSH
T1C085091BB291C1D8C055D0F8C36E8E63DA72F8891674B0FA27C405B13EBBD66673DA64
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1251824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

demo.pdb

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-private-l1-1-0

memchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf _close _dup _dup2 _fileno _fseeki64 _ftelli64 _get_osfhandle _isatty _setmode _wfopen clearerr fclose ferror fflush fgetc fgets fputc fread fwrite setvbuf ungetc

kernel32

DeleteCriticalSection EnterCriticalSection GetLastError GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryA SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-convert-l1-1-0

mbrtowc wcrtomb

api-ms-win-crt-string-l1-1-0

strncmp wcslen

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1e19c5e39f3cbe597a56f4604962cdbe1ceebf6555706b9d476c379505bd5635

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

generic