5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a

Sharing

Copy URL Twitter E-mail

General

Target
5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a
Size 161KB
Sample260806-3fdh4sshqh
SHA256 5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a
MD5 9660bd28fd71770bb958bdd7e721307d
SHA1 1bce334678ddc022d5816c331d517a795400733e
SHA512 e49ff9ab1bf9b0b665a2d879e9ea6fe484e72d1c47e463a98feac20325bd2481a384e119c306400f9b8e08bb07f83de48ce0e6b7e35b3b5d2f2ff77aaba0120a
SSDEEP 3072:MfmRIoY0mMxZdTs68DYm5rez/TMmyNLg4JI:M+XY0V46Wrez/TYlgsI
TLSH
T1B9F33B1DF7F7D6B3D42E567058ABE2A96036F440862D0E0AF71C98345633B2CD78A789
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a

File Explorer

5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a

.dll 161KB

5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a

IMPHASH 1a8156f4501458dedf9f370334f02a03
SHA256 5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a
MD5 9660bd28fd71770bb958bdd7e721307d
SHA1 1bce334678ddc022d5816c331d517a795400733e
SHA512 e49ff9ab1bf9b0b665a2d879e9ea6fe484e72d1c47e463a98feac20325bd2481a384e119c306400f9b8e08bb07f83de48ce0e6b7e35b3b5d2f2ff77aaba0120a
SSDEEP 3072:MfmRIoY0mMxZdTs68DYm5rez/TMmyNLg4JI:M+XY0V46Wrez/TYlgsI
TLSH
T1B9F33B1DF7F7D6B3D42E567058ABE2A96036F440862D0E0AF71C98345633B2CD78A789
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlRaiseException vDbgPrintExWithPrefix

advapi32

GetUserNameA GetUserNameW RegCloseKey RegCreateKeyA RegCreateKeyExW RegDeleteKeyW RegDeleteValueA RegEnumKeyExW RegEnumValueA RegOpenCurrentUser RegOpenKeyExW RegQueryInfoKeyA RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDriveTypeA GetDriveTypeW GetEnvironmentVariableA GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc MultiByteToWideChar QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte lstrcmpW lstrcpyA lstrcpyW lstrlenA lstrlenW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock _vsnprintf abort bsearch calloc free fwrite iswctype memcmp memmove memset sprintf strchr strcmp strcpy strcspn strncmp swprintf vfprintf wcschr wcscpy wcslen

user32

DialogBoxParamW EndDialog GetDlgItem GetWindowLongW GetWindowTextA LoadStringW SetWindowLongW SetWindowTextA

I_MprSaveConn MPR_1 MPR_12 MPR_13 MPR_14 MPR_15 MPR_16 MPR_17 MPR_18 MPR_19 MPR_2 MPR_20 MPR_21 MPR_3 MPR_4 MPR_5 MPR_6 MPR_7 MPR_8 MPR_9 MultinetGetConnectionPerformanceA MultinetGetConnectionPerformanceW MultinetGetErrorTextA MultinetGetErrorTextW NPSAuthenticationDialogA NPSCopyStringA NPSDeviceGetNumberA NPSDeviceGetStringA NPSGetProviderHandleA NPSGetProviderNameA NPSGetSectionNameA NPSNotifyGetContextA NPSNotifyRegisterA NPSSetCustomTextA NPSSetExtendedErrorA PwdChangePasswordA PwdChangePasswordW PwdGetPasswordStatusA PwdGetPasswordStatusW PwdSetPasswordStatusA PwdSetPasswordStatusW RestoreConnectionA0 WNetAddConnection2A WNetAddConnection2W WNetAddConnection3A WNetAddConnection3W WNetAddConnectionA WNetAddConnectionW WNetCachePassword WNetCancelConnection2A WNetCancelConnection2W WNetCancelConnectionA WNetCancelConnectionW WNetClearConnections WNetCloseEnum WNetConnectionDialog WNetConnectionDialog1A WNetConnectionDialog1W WNetConnectionDialog2 WNetDirectoryNotifyA WNetDirectoryNotifyW WNetDisconnectDialog WNetDisconnectDialog1A WNetDisconnectDialog1W WNetDisconnectDialog2 WNetEnumCachedPasswords WNetEnumResourceA WNetEnumResourceW WNetFMXEditPerm WNetFMXGetPermCaps WNetFMXGetPermHelp WNetFormatNetworkNameA WNetFormatNetworkNameW WNetGetCachedPassword WNetGetConnection2A WNetGetConnection2W WNetGetConnection3A WNetGetConnection3W WNetGetConnectionA WNetGetConnectionW WNetGetDirectoryTypeA WNetGetDirectoryTypeW WNetGetHomeDirectoryA WNetGetHomeDirectoryW WNetGetLastErrorA WNetGetLastErrorW WNetGetNetworkInformationA WNetGetNetworkInformationW WNetGetPropertyTextA WNetGetPropertyTextW WNetGetProviderNameA WNetGetProviderNameW WNetGetProviderTypeA WNetGetProviderTypeW WNetGetResourceInformationA WNetGetResourceInformationW WNetGetResourceParentA WNetGetResourceParentW WNetGetSearchDialog WNetGetUniversalNameA WNetGetUniversalNameW WNetGetUserA WNetGetUserW WNetLogoffA WNetLogoffW WNetLogonA WNetLogonNotify WNetLogonW WNetOpenEnumA WNetOpenEnumW WNetPasswordChangeNotify WNetPropertyDialogA WNetPropertyDialogW WNetRemoveCachedPassword WNetRestoreConnection WNetRestoreConnection2W WNetRestoreConnectionA WNetRestoreConnectionW WNetSetConnectionA WNetSetConnectionW WNetSetLastErrorA WNetSetLastErrorW WNetSupportGlobalEnum WNetUseConnectionA WNetUseConnectionW WNetVerifyPasswordA WNetVerifyPasswordW

Name

.text

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5844c474d961bcae469c9a02f66899279034d69160db498c1b0cb476deb7101a

ntdll

advapi32

kernel32

msvcrt

user32

generic