585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56

Sharing

Copy URL Twitter E-mail

General

Target
585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56
Size 212KB
Sample260804-vceb8san8x
SHA256 585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56
MD5 28911c8aeef7340a6367a716c2a952a7
SHA1 bf184edc4a95582d5404cf355c8f5b5d09fe296c
SHA512 1c43a8e867899f9aebc6126b1e65ffb7060a459472af5b3667ab40c0beb6883a1b133acc7a8bac6119a77e3dac3bfaefa91c8e64440920dfcec5b21ca869851b
SSDEEP 3072:WNJvjcHMDqGlHa1IrYhhjuN7ZC7g2encYmKnpk:qBjs1jjuNg
TLSH
T1A124D645BBF61051F4B72B741EFEE9FAC72EBF628A388C1E931082490A725456421B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56

File Explorer

585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56

.dll 212KB

585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56

IMPHASH c865fe980789ce58e9035ea1e8178148
SHA256 585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56
MD5 28911c8aeef7340a6367a716c2a952a7
SHA1 bf184edc4a95582d5404cf355c8f5b5d09fe296c
SHA512 1c43a8e867899f9aebc6126b1e65ffb7060a459472af5b3667ab40c0beb6883a1b133acc7a8bac6119a77e3dac3bfaefa91c8e64440920dfcec5b21ca869851b
SSDEEP 3072:WNJvjcHMDqGlHa1IrYhhjuN7ZC7g2encYmKnpk:qBjs1jjuNg
TLSH
T1A124D645BBF61051F4B72B741EFEE9FAC72EBF628A388C1E931082490A725456421B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _vsnprintf

spoolss

EnumPortsW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcmp memcpy memmove strchr strcmp strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

user32

LoadStringW wsprintfW

Name

.text

Size

72KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

138B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

585d355a4f1932c79c31e998fb43d48498dcd2568922893cd1c091a79a991a56

advapi32

kernel32

ntdll

spoolss

ucrtbase

user32

generic