121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612

Sharing

Copy URL Twitter E-mail

General

Target
121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612
Size 406KB
Sample260806-3cp3qsshld
SHA256 121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612
MD5 efe0fc714aa84ccb974ea26ab75d9eda
SHA1 2c4992c8ec1548b4df4952b61930b0870b8f71a4
SHA512 8676ae170dc0c9ee8da09ba7f6b370799d86c1b74ad917db799ce19284cd1c6cf8640932fe144335b9c79206b7e651bf70f14fd0e01169ef2b0c5b8933602a19
SSDEEP 3072:vDHAOSXzWca2C5yekF33No+UaTWiJ3pdey+NDhOx8JRHmq+sn:vYjta2CISdND68Jkq+i
TLSH
T14994CD1263EB411AF6F33F795DBA44684F3BBD92AD76C21E219C412E4FB35449A60332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612

File Explorer

121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612

.exe 406KB

121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612

IMPHASH 582cee83d821deb2cccd7d27bde0d5e3
SHA256 121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612
MD5 efe0fc714aa84ccb974ea26ab75d9eda
SHA1 2c4992c8ec1548b4df4952b61930b0870b8f71a4
SHA512 8676ae170dc0c9ee8da09ba7f6b370799d86c1b74ad917db799ce19284cd1c6cf8640932fe144335b9c79206b7e651bf70f14fd0e01169ef2b0c5b8933602a19
SSDEEP 3072:vDHAOSXzWca2C5yekF33No+UaTWiJ3pdey+NDhOx8JRHmq+sn:vYjta2CISdND68Jkq+i
TLSH
T14994CD1263EB411AF6F33F795DBA44684F3BBD92AD76C21E219C412E4FB35449A60332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

vDbgPrintExWithPrefix

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

advapi32_vista

RegDeleteTreeW

kernel32

CloseHandle CreateFileW DeleteCriticalSection EnterCriticalSection FormatMessageW GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc MultiByteToWideChar QueryPerformanceCounter ReadConsoleW SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW lstrcmpiW lstrcpyW lstrlenW

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _errno _fpreset _initterm _iob _lock _onexit _unlock _vsnprintf _wcmdln _wcsnicmp _wcsupr _wfopen abort bsearch calloc exit fclose fread free fwrite iswctype malloc memcmp memmove realloc signal sprintf strchr strcmp strcpy strcspn strncmp strpbrk swprintf towlower towupper vfprintf wcschr wcsncmp wcspbrk wcsrchr wcsstr wcstoul _wcsicmp

user32

LoadStringW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

121381e3c9c2719e3ad7446bf5c86360c205b3d2f2d734220abbab09d6825612

ntdll

advapi32

advapi32_vista

kernel32

msvcrt

user32

generic