2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77

Sharing

Copy URL Twitter E-mail

General

Target
2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77
Size 431KB
Sample260806-3ef8lswtfs
SHA256 2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77
MD5 5a99522112005e7964216fde7855df45
SHA1 46f9fb20ce6730aa0c3b7c741f93f4a565f3ac6a
SHA512 79c248b0da4e36723ea6d61fb4e9a08e4e14f93197078f8fb7c1144a9f541e623918e98c1da871c0f7f8c39121fd9aef81d3666a9ddab9126953077c6d638f0b
SSDEEP 3072:xaZrXKpUZr7aoPr7yHy/kKXbBsQBbByFnOB7409tUS2YBloA3BYdibB+S6RBWpNU:eU2PpXfB4noH2BACiiRB+YaQnZ
TLSH
T12B945642A6FE4249F6F73E745EB591658A377CA6A93DC64D019C100E0BF3E409E60BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77

File Explorer

2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77

.exe 431KB

2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77

IMPHASH db6ed350f2dd22503f721f57af62116a
SHA256 2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77
MD5 5a99522112005e7964216fde7855df45
SHA1 46f9fb20ce6730aa0c3b7c741f93f4a565f3ac6a
SHA512 79c248b0da4e36723ea6d61fb4e9a08e4e14f93197078f8fb7c1144a9f541e623918e98c1da871c0f7f8c39121fd9aef81d3666a9ddab9126953077c6d638f0b
SSDEEP 3072:xaZrXKpUZr7aoPr7yHy/kKXbBsQBbByFnOB7409tUS2YBloA3BYdibB+S6RBWpNU:eU2PpXfB4noH2BACiiRB+YaQnZ
TLSH
T12B945642A6FE4249F6F73E745EB591658A377CA6A93DC64D019C100E0BF3E409E60BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

45042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlAllocateHeap RtlFreeHeap RtlGetNtProductType RtlSecondsSince1970ToTime RtlTimeToSecondsSince1970

advapi32

CloseServiceHandle ControlService EnumServicesStatusW OpenSCManagerW OpenServiceW StartServiceW

kernel32

DeleteCriticalSection EnterCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime FillConsoleOutputCharacterW FindResourceExW FlushFileBuffers FormatMessageW FreeLibrary GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetFileType GetLastError GetLocaleInfoW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MultiByteToWideChar QueryPerformanceCounter ReadFile RtlUnwind SetConsoleCursorPosition SetConsoleMode SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

mpr

WNetCancelConnection2W WNetCloseEnum WNetEnumResourceW WNetOpenEnumW WNetUseConnectionW

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsicmp _wcslwr _wcsnicmp abort calloc exit free fwrite iswctype malloc memmove memset printf qsort rand signal srand strncmp swprintf towupper vfprintf wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsncpy wcspbrk wcsstr wcstol wcstoul

netapi32

NetApiBufferFree NetGroupAdd NetGroupAddUser NetGroupDel NetGroupDelUser NetGroupEnum NetGroupGetInfo NetGroupGetUsers NetGroupSetInfo NetLocalGroupAdd NetLocalGroupAddMembers NetLocalGroupDel NetLocalGroupDelMembers NetLocalGroupEnum NetLocalGroupGetInfo NetLocalGroupGetMembers NetLocalGroupSetInfo NetServerGetInfo NetServerSetInfo NetServerTransportEnum NetSessionDel NetSessionEnum NetShareAdd NetShareDel NetShareEnum NetShareGetInfo NetStatisticsGet NetUserAdd NetUserDel NetUserEnum NetUserGetGroups NetUserGetInfo NetUserGetLocalGroups NetUserModalsGet NetUserModalsSet NetUserSetInfo NetWkstaGetInfo NetWkstaTransportEnum NetWkstaUserGetInfo

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2f7eda1d64826e57b19543a4e6e9923afdcaccade047b48e23d389ec877c6c77

ntdll

advapi32

kernel32

mpr

msvcrt

netapi32

generic