ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1

Sharing

Copy URL Twitter E-mail

General

Target
ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1
Size 196KB
Sample260806-sdq2badq2x
SHA256 ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1
MD5 b7a488a5cb6cf33e1e2545e6d6f27147
SHA1 2665fa9d0970184a8ca4256190b497f71dd342ac
SHA512 37f0982009a1b04c67d0c9eaa8a6bb776410a55151732e42a69c4cb64bdb7dee51890c1a73d799285661d402e9d176a90a09e8d400689c7ba344d64dcffe0b9b
SSDEEP 6144:jzQyiLHz40gQt23nJ6vOS0lcc0rbLurxl:XQvs0N23J6WS0lp0L0x
TLSH
T15A144A2D22EE10E4E47B917CCC424256E6B27431272262EF15E0C57C9F27AEDBA78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1

File Explorer

ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1

.exe 196KB

ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1

IMPHASH 09ed737a03db7295bf734a9953f6eb5e
SHA256 ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1
MD5 b7a488a5cb6cf33e1e2545e6d6f27147
SHA1 2665fa9d0970184a8ca4256190b497f71dd342ac
SHA512 37f0982009a1b04c67d0c9eaa8a6bb776410a55151732e42a69c4cb64bdb7dee51890c1a73d799285661d402e9d176a90a09e8d400689c7ba344d64dcffe0b9b
SSDEEP 6144:jzQyiLHz40gQt23nJ6vOS0lcc0rbLurxl:XQvs0N23J6WS0lp0L0x
TLSH
T15A144A2D22EE10E4E47B917CCC424256E6B27431272262EF15E0C57C9F27AEDBA78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notepad.pdb

kernel32

GetProcAddress CreateMutexExW AcquireSRWLockShared DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent GlobalFree GetLocaleInfoW CreateFileW ReadFile GetACP MulDiv GetCurrentProcess GetCommandLineW HeapSetInformation FreeLibrary LocalFree LocalAlloc FindFirstFileW FindClose FoldStringW GetModuleFileNameW GetUserDefaultUILanguage HeapFree HeapAlloc GetTimeFormatW WideCharToMultiByte WriteFile GetFileAttributesW LocalLock LocalUnlock DeleteFileW SetEndOfFile GetFileAttributesExW GetFileInformationByHandle CreateFileMappingW MapViewOfFile MultiByteToWideChar LocalReAlloc UnmapViewOfFile GetFullPathNameW LocalSize GetStartupInfoW lstrcmpiW FindNLSString GlobalLock GlobalUnlock GlobalAlloc GetDiskFreeSpaceExW CreateDirectoryW RegisterApplicationRestart CreateSemaphoreExW CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer CloseHandle OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive CloseThreadpoolTimer OutputDebugStringW ReleaseSRWLockExclusive GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject WaitForThreadpoolTimerCallbacks InitializeCriticalSectionEx LeaveCriticalSection GetModuleHandleExW ReleaseSemaphore EnterCriticalSection GetDateFormatW SetLastError GetLocalTime ResolveDelayLoadedAPI DelayLoadFailureHook GetModuleFileNameA

gdi32

CreateDCW StartPage StartDocW SetAbortProc DeleteDC EndDoc AbortDoc EndPage GetTextMetricsW SetBkMode LPtoDP SetWindowExtEx SetViewportExtEx SetMapMode GetTextExtentPoint32W TextOutW EnumFontsW GetTextFaceW SelectObject DeleteObject CreateFontIndirectW GetDeviceCaps

user32

PostMessageW MessageBoxW GetMenu CheckMenuItem GetSubMenu EnableMenuItem ShowWindow GetDC ReleaseDC SetCursor GetDpiForWindow SetActiveWindow LoadStringW DefWindowProcW IsIconic SetFocus PostQuitMessage DestroyWindow MessageBeep GetForegroundWindow GetDlgCtrlID SetWindowPos RedrawWindow GetKeyboardLayout CharNextW SetWinEventHook GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW UnhookWinEvent SetWindowTextW OpenClipboard IsClipboardFormatAvailable CloseClipboard SetDlgItemTextW GetDlgItemTextW EndDialog SendDlgItemMessageW SetScrollPos InvalidateRect UpdateWindow GetWindowPlacement SetWindowPlacement CharUpperW GetSystemMenu LoadAcceleratorsW SetWindowLongW CreateWindowExW MonitorFromWindow RegisterWindowMessageW LoadCursorW RegisterClassExW GetWindowTextLengthW GetWindowLongW PeekMessageW GetWindowTextW EnableWindow CreateDialogParamW DrawTextExW LoadIconW LoadImageW DialogBoxParamW SetThreadDpiAwarenessContext SendMessageW MoveWindow GetClientRect GetFocus

api-ms-win-crt-string-l1-1-0

memset wcsnlen wcscmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wtol _o_exit _o_free _o_iswdigit _o_malloc _o_terminate _o_toupper __CxxFrameHandler3 _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o___stdio_common_vswprintf __C_specific_handler memcmp memcpy memmove

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoCreateGuid

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsFileSpecW PathFindExtensionW PathFileExistsW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference

api-ms-win-core-synch-l1-1-0

SetEvent CreateEventExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled

api-ms-win-core-synch-l1-2-0

Sleep

comctl32

CreateStatusWindowW ord345

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee7e6f48be3f68c364e5c55952898add421743941553e9a71284b558c6ea3be1

kernel32

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-path-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

comctl32

generic