b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf

Sharing

Copy URL Twitter E-mail

General

Target
b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf
Size 288KB
Sample260806-l7cbpaszfx
SHA256 b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf
MD5 939fef73e9bea8ea5fae2886d0a74e7d
SHA1 152c513e5d2bc4993ccebc9d7b75e2063bad801d
SHA512 0fa5096fd49d1974e7b8f83ad5bd9930d71dd006309e325f4f64060bbd0af89f10a8324386255f2632f6b966802dcc64514cd455c6db82525371bb204db611cc
SSDEEP 6144:ttJx4E62NRjFr2oS8lMDTswWylHKHgjUDUDX:4ETxGWylpjAOX
TLSH
T1A4545D5FB3921CBCC627E1758297D771B531F8110326EE6F16A4CB33AF60D600B5A9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf

File Explorer

b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf

.dll 288KB

b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf

IMPHASH 1cec3fbd5c6c9311657f8f54b966f29c
SHA256 b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf
MD5 939fef73e9bea8ea5fae2886d0a74e7d
SHA1 152c513e5d2bc4993ccebc9d7b75e2063bad801d
SHA512 0fa5096fd49d1974e7b8f83ad5bd9930d71dd006309e325f4f64060bbd0af89f10a8324386255f2632f6b966802dcc64514cd455c6db82525371bb204db611cc
SSDEEP 6144:ttJx4E62NRjFr2oS8lMDTswWylHKHgjUDUDX:4ETxGWylpjAOX
TLSH
T1A4545D5FB3921CBCC627E1758297D771B531F8110326EE6F16A4CB33AF60D600B5A9A8
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

InitializeSecurityDescriptor RegCloseKey RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl SetServiceStatus

kernel32

CloseHandle ConnectNamedPipe CreateEventW CreateNamedPipeW CreateThread DeleteCriticalSection DisconnectNamedPipe EnterCriticalSection ExitProcess FormatMessageA GetACP GetCurrentDirectoryW GetCurrentProcessId GetEnvironmentVariableW GetFileSize GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _errno _initterm _lock _unlock _wcsicmp abort calloc fputc fputs free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset realloc strchr strcmp strerror strlen strncmp strtoul vfprintf wcscat_s wcscmp wcscpy_s wcslen _read

ntdll

RtlAdjustPrivilege

shlwapi

PathFileExistsW

user32

GetCursorPos

Name

.8hmt0u

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.yxn82

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.7xut4d

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vjkba

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.4lp

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dm365dy

Size

512B

Virtual Size

77B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.o2qx

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.6kju711

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b32eaefa3eecb54a00e3b6cf27d8899991e87b6a3016957b14b05ab8b09f1bcf

advapi32

kernel32

msvcrt

ntdll

shlwapi

user32

generic