0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c

Sharing

Copy URL Twitter E-mail

General

Target
0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c
Size 119KB
Sample260806-3erdksshpc
SHA256 0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c
MD5 fa7e494029ce6c1370b2148f98216e61
SHA1 a5274afe1e5d279f3f1911a7052e620a3f7aa6dc
SHA512 68305260dee7cbca4353108b6b33771b8f19f6315b4ee120c9bf651287e6597bd9827f464554316e8914b317b6a2db6dcd44c13f6264566fbe38e13789cbe2f6
SSDEEP 3072:Avb2T+Xk6ryXnZXSVtBfbJJ8M+Ba02FJ95:Az2SXvrykea02zz
TLSH
T148C3D900EBB29B67DEF24E7145A6F2AE1672FC206621CD4ED701274A1961B10C7DF32E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c

File Explorer

0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c

.dll 119KB

0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c

IMPHASH 2cfe563ba0f28b2cbaaf82b9924f0df2
SHA256 0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c
MD5 fa7e494029ce6c1370b2148f98216e61
SHA1 a5274afe1e5d279f3f1911a7052e620a3f7aa6dc
SHA512 68305260dee7cbca4353108b6b33771b8f19f6315b4ee120c9bf651287e6597bd9827f464554316e8914b317b6a2db6dcd44c13f6264566fbe38e13789cbe2f6
SSDEEP 3072:Avb2T+Xk6ryXnZXSVtBfbJJ8M+Ba02FJ95:Az2SXvrykea02zz
TLSH
T148C3D900EBB29B67DEF24E7145A6F2AE1672FC206621CD4ED701274A1961B10C7DF32E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlRaiseException vDbgPrintExWithPrefix

advapi32

RegCloseKey RegCreateKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

CreatePropertySheetPageW DestroyPropertySheetPage

kernel32

CloseHandle CreateMutexW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc QueryPerformanceCounter ReleaseMutex SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _ultow _unlock _vsnprintf _wcsicmp _wcsnicmp _wtoi abort bsearch calloc free fwrite memcmp memmove memset sprintf strchr strcmp strcpy strcspn strncmp swprintf swscanf vfprintf wcscat wcschr wcscpy wcslen wcstoul

setupapi

SetupCloseInfFile SetupDiCallClassInstaller SetupDiCreateDevRegKeyW SetupDiGetActualSectionToInstallW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiGetSelectedDriverW SetupDiInstallDevice SetupDiOpenDevRegKey SetupDiRemoveDevice SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupInstallFromInfSectionW SetupOpenInfFileW

user32

EnableWindow GetDlgItem GetWindowLongW LoadStringW PostMessageW SendMessageW SetWindowLongW

Name

.text

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

344B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

407B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0beb20b1200394a9d7ab39b332227c5e72ebc14a9ade6109ee63092a161f661c

ntdll

advapi32

comctl32

kernel32

msvcrt

setupapi

user32

generic