30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531

Sharing

Copy URL Twitter E-mail

General

Target
30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531
Size 214KB
Sample260804-ynfafsga87
SHA256 30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531
MD5 7eb385f36193b412b9e7f339e652fb58
SHA1 28000049986ca22d3dc2e1072bef73b8cd980d70
SHA512 7fd03ec10dd426b4e0564058edb97baf224fed78ee766a36bc99730360fb94295a8bd2e7114e20623544d4eef4a0de53c59129db19b616d4963665962910870f
SSDEEP 3072:BqAl5Gz2Uv48KYxPRdFfh7xseVmFknX4a7WClPTenyJ3OYIYCxQ08xp68fIxTp:5lcz2hCjnZw/UWebKBYQknI
TLSH
T104248CA72EB4F5F6F136213D4910814887217C35DED1DB8F83A58B522E736938DBAA31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531

File Explorer

30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531

.exe 214KB

30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531

IMPHASH 344b59bd3f3b9dd2eb0bfaf392f3ebc2
SHA256 30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531
MD5 7eb385f36193b412b9e7f339e652fb58
SHA1 28000049986ca22d3dc2e1072bef73b8cd980d70
SHA512 7fd03ec10dd426b4e0564058edb97baf224fed78ee766a36bc99730360fb94295a8bd2e7114e20623544d4eef4a0de53c59129db19b616d4963665962910870f
SSDEEP 3072:BqAl5Gz2Uv48KYxPRdFfh7xseVmFknX4a7WClPTenyJ3OYIYCxQ08xp68fIxTp:5lcz2hCjnZw/UWebKBYQknI
TLSH
T104248CA72EB4F5F6F136213D4910814887217C35DED1DB8F83A58B522E736938DBAA31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualFree GetModuleFileNameA lstrcpyA VirtualAlloc lstrlenA WriteConsoleW CreateFileW CreateProcessA GetLastError CloseHandle WriteFile SetFilePointer ReadFile GetFileSize CreateFileA CreateDirectoryA lstrcatA GetEnvironmentVariableA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

wsprintfA

advapi32

StartServiceA OpenServiceA OpenSCManagerA CreateServiceA CloseServiceHandle ChangeServiceConfig2A RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey

Name

.text

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pcfg

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

30c950bad322be39deb0207d6af2a5aeb0ed8a005b4f2e50e47c8e6caaff0531

kernel32

user32

advapi32

generic