15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70

Sharing

Copy URL Twitter E-mail

General

Target
15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70
Size 289KB
Sample260804-vh5rdadh78
SHA256 15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70
MD5 97e75261be3340f3c990b4c99ac082ea
SHA1 ee9659fc0cdc57c7749335550b1e05a37caddc09
SHA512 2b61c31da7525bab850695697125d6913fc2e8c1755b9ac3fffc8435dbbeea8188600834baa6d8222e415ecc63a02d7adbe585b151c2856c07855c9089a495fe
SSDEEP 3072:jBn3IfRwZfXvzK2urF0V73HJnlt5t2noQW0dCSaGmDrntdwRuOL18nfAg0FubqmS:Nn4fRw5Up0rjmrdYGmteyAOtGxHRTzG
TLSH
T100549D2171D5C0B3D17385320D79EAA6653CBC300B6196EF93D86E2EDE345C1AA36B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70

File Explorer

15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70

.exe 289KB

15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70

IMPHASH 6662cd38fc966a3e79812bc2ee126490
SHA256 15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70
MD5 97e75261be3340f3c990b4c99ac082ea
SHA1 ee9659fc0cdc57c7749335550b1e05a37caddc09
SHA512 2b61c31da7525bab850695697125d6913fc2e8c1755b9ac3fffc8435dbbeea8188600834baa6d8222e415ecc63a02d7adbe585b151c2856c07855c9089a495fe
SSDEEP 3072:jBn3IfRwZfXvzK2urF0V73HJnlt5t2noQW0dCSaGmDrntdwRuOL18nfAg0FubqmS:Nn4fRw5Up0rjmrdYGmteyAOtGxHRTzG
TLSH
T100549D2171D5C0B3D17385320D79EAA6653CBC300B6196EF93D86E2EDE345C1AA36B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88819

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

Shell_NotifyIconW ShellExecuteExW

comctl32

InitCommonControlsEx

ws2_32

WSAStartup gethostname gethostbyname inet_ntoa WSACleanup

shlwapi

PathFileExistsW

kernel32

GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW CopyFileW MultiByteToWideChar WideCharToMultiByte GetFileAttributesW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW DeleteFileW RemoveDirectoryW GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter SetStdHandle TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapSize GetFileType GetACP WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess HeapReAlloc HeapFree HeapAlloc LoadLibraryExW FreeLibrary GetLastError RtlUnwind RaiseException GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW GetCurrentProcess CreateFileW

user32

LoadIconW LoadCursorW GetClassNameW SetWindowLongW GetWindowLongW PtInRect FillRect MapWindowPoints ClientToScreen GetCursorPos SetCursor AdjustWindowRect GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DestroyIcon UpdateWindow DrawTextW AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics EnableWindow GetDlgCtrlID ShowWindow DestroyWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW TrackMouseEvent MessageBoxW DispatchMessageW TranslateMessage GetMessageW SetForegroundWindow TrackPopupMenu

gdi32

DeleteObject CreateFontW CreateSolidBrush SelectObject SetBkColor SetBkMode SetTextColor EnumFontFamiliesExW GetStockObject

Name

.text

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

15b978bd3eb30a617036340dcb1d5e3e1867398c21146cde3cc42a8f176f9a70

shell32

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

generic