52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94

Sharing

Copy URL Twitter E-mail

General

Target
52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94
Size 196KB
Sample260806-sdsj5sdq21
SHA256 52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94
MD5 549cd1fc6ebff60608f15cfa7bc535a6
SHA1 fee8133eaff9c68a06c8f4ed38cf5c031819abea
SHA512 2ef77cea851d46e122531007273ab36e47ac44a352549b12a0d3d71cecf3d3cc129f27ffb6e8f2b14bb4fd16e0e500ba4a44989480271f05907426a5d0becfaf
SSDEEP 6144:HzQyiLHz40gQt23nJ6vOS0lcc0rbLurxl:TQvs0N23J6WS0lp0L0x
TLSH
T1D0144A2D22EE10E4E47B917CCC424256E6B27431272262EF15E0C57C9F27AEDBA78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94

File Explorer

52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94

.exe 196KB

52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94

IMPHASH 09ed737a03db7295bf734a9953f6eb5e
SHA256 52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94
MD5 549cd1fc6ebff60608f15cfa7bc535a6
SHA1 fee8133eaff9c68a06c8f4ed38cf5c031819abea
SHA512 2ef77cea851d46e122531007273ab36e47ac44a352549b12a0d3d71cecf3d3cc129f27ffb6e8f2b14bb4fd16e0e500ba4a44989480271f05907426a5d0becfaf
SSDEEP 6144:HzQyiLHz40gQt23nJ6vOS0lcc0rbLurxl:TQvs0N23J6WS0lp0L0x
TLSH
T1D0144A2D22EE10E4E47B917CCC424256E6B27431272262EF15E0C57C9F27AEDBA78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notepad.pdb

kernel32

GetProcAddress CreateMutexExW AcquireSRWLockShared DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent GlobalFree GetLocaleInfoW CreateFileW ReadFile GetACP MulDiv GetCurrentProcess GetCommandLineW HeapSetInformation FreeLibrary LocalFree LocalAlloc FindFirstFileW FindClose FoldStringW GetModuleFileNameW GetUserDefaultUILanguage HeapFree HeapAlloc GetTimeFormatW WideCharToMultiByte WriteFile GetFileAttributesW LocalLock LocalUnlock DeleteFileW SetEndOfFile GetFileAttributesExW GetFileInformationByHandle CreateFileMappingW MapViewOfFile MultiByteToWideChar LocalReAlloc UnmapViewOfFile GetFullPathNameW LocalSize GetStartupInfoW lstrcmpiW FindNLSString GlobalLock GlobalUnlock GlobalAlloc GetDiskFreeSpaceExW CreateDirectoryW RegisterApplicationRestart CreateSemaphoreExW CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer CloseHandle OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive CloseThreadpoolTimer OutputDebugStringW ReleaseSRWLockExclusive GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject WaitForThreadpoolTimerCallbacks InitializeCriticalSectionEx LeaveCriticalSection GetModuleHandleExW ReleaseSemaphore EnterCriticalSection GetDateFormatW SetLastError GetLocalTime ResolveDelayLoadedAPI DelayLoadFailureHook GetModuleFileNameA

gdi32

CreateDCW StartPage StartDocW SetAbortProc DeleteDC EndDoc AbortDoc EndPage GetTextMetricsW SetBkMode LPtoDP SetWindowExtEx SetViewportExtEx SetMapMode GetTextExtentPoint32W TextOutW EnumFontsW GetTextFaceW SelectObject DeleteObject CreateFontIndirectW GetDeviceCaps

user32

PostMessageW MessageBoxW GetMenu CheckMenuItem GetSubMenu EnableMenuItem ShowWindow GetDC ReleaseDC SetCursor GetDpiForWindow SetActiveWindow LoadStringW DefWindowProcW IsIconic SetFocus PostQuitMessage DestroyWindow MessageBeep GetForegroundWindow GetDlgCtrlID SetWindowPos RedrawWindow GetKeyboardLayout CharNextW SetWinEventHook GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW UnhookWinEvent SetWindowTextW OpenClipboard IsClipboardFormatAvailable CloseClipboard SetDlgItemTextW GetDlgItemTextW EndDialog SendDlgItemMessageW SetScrollPos InvalidateRect UpdateWindow GetWindowPlacement SetWindowPlacement CharUpperW GetSystemMenu LoadAcceleratorsW SetWindowLongW CreateWindowExW MonitorFromWindow RegisterWindowMessageW LoadCursorW RegisterClassExW GetWindowTextLengthW GetWindowLongW PeekMessageW GetWindowTextW EnableWindow CreateDialogParamW DrawTextExW LoadIconW LoadImageW DialogBoxParamW SetThreadDpiAwarenessContext SendMessageW MoveWindow GetClientRect GetFocus

api-ms-win-crt-string-l1-1-0

memset wcsnlen wcscmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wtol _o_exit _o_free _o_iswdigit _o_malloc _o_terminate _o_toupper __CxxFrameHandler3 _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o___stdio_common_vswprintf __C_specific_handler memcmp memcpy memmove

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoCreateGuid

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsFileSpecW PathFindExtensionW PathFileExistsW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference

api-ms-win-core-synch-l1-1-0

SetEvent CreateEventExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled

api-ms-win-core-synch-l1-2-0

Sleep

comctl32

CreateStatusWindowW ord345

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

52d8fe8fb4fafdd96f442d91bbc94167a635e7e78bdb640b205c366274a7cd94

kernel32

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-path-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

comctl32

generic