0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455

General

Target
0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455
Size 261KB
Sample260805-e5m7vayare
SHA256 0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455
MD5 fb271fc38b7f128681110e77ba8d8017
SHA1 3fb40d429b148f63cf634350be17da2cd650c8f7
SHA512 c4ee272fde79e667b5239008f47ab51bad5c5ca163f891d0362b8c1d91d07a0986fe60c272a3e4ad94476acbaecd472d319ddb27854b71caf4e7c87af454ac10
SSDEEP 3072:3XH9ZFkL/RiPkQCi1VfpDHZYwZdZnIE8A0G3J3GYA99e8+iVu7TLAi1F0ADCa+hU:9/kL/3MVf9qct8yI/d+jLDrKLh6B3
TLSH
T19044AE69B7A50CBAE477C27DC9534A46E3F2B8460760EBCF07A046252F237E1953EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455

File Explorer

0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455

.dll 261KB

0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455

IMPHASH b838fa33137ad1059b061cb0b624ab90
SHA256 0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455
MD5 fb271fc38b7f128681110e77ba8d8017
SHA1 3fb40d429b148f63cf634350be17da2cd650c8f7
SHA512 c4ee272fde79e667b5239008f47ab51bad5c5ca163f891d0362b8c1d91d07a0986fe60c272a3e4ad94476acbaecd472d319ddb27854b71caf4e7c87af454ac10
SSDEEP 3072:3XH9ZFkL/RiPkQCi1VfpDHZYwZdZnIE8A0G3J3GYA99e8+iVu7TLAi1F0ADCa+hU:9/kL/3MVf9qct8yI/d+jLDrKLh6B3
TLSH
T19044AE69B7A50CBAE477C27DC9534A46E3F2B8460760EBCF07A046252F237E1953EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegisterEventSourceW ReportEventW RegisterServiceCtrlHandlerExW SetServiceStatus DeregisterEventSource

kernel32

CloseHandle GetLastError SetEvent WaitForSingleObject CreateEventW CreateThread DisableThreadLibraryCalls InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetLocalTime GetModuleFileNameA lstrcpynA lstrcatA VirtualAlloc VirtualFree GetModuleHandleA GetProcAddress LoadLibraryA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx InterlockedFlushSList SetLastError DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree GetStdHandle GetFileType HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetStringTypeW CreateFileW GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc ReadFile ReadConsoleW SetEndOfFile

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0e64a0c37eb5d2f489aedfb4f6edd49e4ad04a894e80b75d812ff43a9e254455

advapi32

kernel32

generic