84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308

Sharing

Copy URL Twitter E-mail

General

Target
84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308
Size 299KB
Sample260805-bca52abc73
SHA256 84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308
MD5 25306510d8a6b867cb0d7649c82dec9d
SHA1 f5784a90a35e57aa01f25373af0b67d19f03b04c
SHA512 cb7beed7797fae39dab42c382c849633c7f6d7bf1dffc9346973aa6b7887668c01a90bd955357ee4026401bd1f19ae5d65088957cb99dafe99e691003b0850ec
SSDEEP 6144:ZdKNEzd0BWDtgRAd6yRptgMSSvoAOrxqUb:Z9zd0BWDBYyVgQQ/qUb
TLSH
T145549C017696C032E2724932197CDB77513DB8304F269ADBE3D45F2EDA745C2AA31B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308

File Explorer

84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308

.exe 299KB

84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308

IMPHASH e57f76ab1e34ebfc9b51875e8124965c
SHA256 84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308
MD5 25306510d8a6b867cb0d7649c82dec9d
SHA1 f5784a90a35e57aa01f25373af0b67d19f03b04c
SHA512 cb7beed7797fae39dab42c382c849633c7f6d7bf1dffc9346973aa6b7887668c01a90bd955357ee4026401bd1f19ae5d65088957cb99dafe99e691003b0850ec
SSDEEP 6144:ZdKNEzd0BWDtgRAd6yRptgMSSvoAOrxqUb:Z9zd0BWDBYyVgQQ/qUb
TLSH
T145549C017696C032E2724932197CDB77513DB8304F269ADBE3D45F2EDA745C2AA31B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95305

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

Shell_NotifyIconW ShellExecuteExW

comctl32

InitCommonControlsEx

ws2_32

inet_ntoa gethostname WSACleanup WSAStartup gethostbyname

shlwapi

PathFileExistsW

kernel32

FindFirstFileW FindNextFileW FindClose MultiByteToWideChar GetCurrentDirectoryW CopyFileW WideCharToMultiByte WritePrivateProfileStringW GetPrivateProfileIntW GetFileAttributesW GetPrivateProfileStringW GetLocalTime DeleteFileW RemoveDirectoryW GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter SetStdHandle TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapSize GetFileType GetACP WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess HeapFree HeapReAlloc HeapAlloc LoadLibraryExW FreeLibrary GetLastError RaiseException RtlUnwind GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW GetCurrentProcess CreateFileW

user32

LoadIconW GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW PostMessageW GetWindowRect DestroyWindow GetDC FillRect CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW CreatePopupMenu RegisterClassExW TrackPopupMenu ShowWindow GetDlgCtrlID ClientToScreen MapWindowPoints DestroyIcon AdjustWindowRect DestroyMenu LoadCursorW SetCursor SetWindowLongW GetClientRect AppendMenuW DrawTextW PostQuitMessage PtInRect UpdateWindow SetForegroundWindow InvalidateRect ReleaseDC GetCursorPos BeginPaint EndPaint EnableWindow GetWindowTextW GetMessageW MessageBoxW DispatchMessageW TranslateMessage TrackMouseEvent GetClassNameW

gdi32

SetBkColor DeleteObject CreateSolidBrush GetStockObject CreateFontW EnumFontFamiliesExW SelectObject SetBkMode SetTextColor

Name

.text

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

584B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

84d9dbe132df3b207472daf0712a481f2c4a1deb6aff3ffd680ad6a578416308

shell32

comctl32

ws2_32

shlwapi

kernel32

user32

gdi32

generic