53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1

Sharing

Copy URL Twitter E-mail

General

Target
53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1
Size 442KB
Sample260806-wt4h5axeja
SHA256 53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1
MD5 9dcbff03dbddad35b4d45706ce4833b4
SHA1 d9a086de401634e872d222cbb9af3c2293dd941b
SHA512 fa4972aebd5918dff869b9f18be0d36d928c06d73e308f97ff72c4edb4684d390038212f7b053d814a58f51e7ee4d5fa987607eac2c7b6e8de0c424d819677da
SSDEEP 3072:lNEvxzGVCYAFLwGYz3nuhQA/RFe4uM88ZzjIhKdp6IfM/NX4FyEP6:/EvxjSGAXuh94M5QhKdp6t/NXEC
TLSH
T1A8A4C650B2E458A7F667C33958E3D2113B39B6516367CB0BD2046D2D0A2B7C32ED6B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1

File Explorer

53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1

.exe 442KB

53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1

IMPHASH e16ef1cbd158b3c422629414e4f95f1f
SHA256 53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1
MD5 9dcbff03dbddad35b4d45706ce4833b4
SHA1 d9a086de401634e872d222cbb9af3c2293dd941b
SHA512 fa4972aebd5918dff869b9f18be0d36d928c06d73e308f97ff72c4edb4684d390038212f7b053d814a58f51e7ee4d5fa987607eac2c7b6e8de0c424d819677da
SSDEEP 3072:lNEvxzGVCYAFLwGYz3nuhQA/RFe4uM88ZzjIhKdp6IfM/NX4FyEP6:/EvxjSGAXuh94M5QhKdp6t/NXEC
TLSH
T1A8A4C650B2E458A7F667C33958E3D2113B39B6516367CB0BD2046D2D0A2B7C32ED6B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW SystemFunction036

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _crt_atexit _errno _fstat32 _get_initial_narrow_environment _initialize_narrow_environment _initterm _initterm_e _lseek _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memmove qsort realloc strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

40KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

60KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

53ef363a92ffe05704c9cf8546ddf0658601ac72d8d5affc3a909c1d016cfee1

advapi32

kernel32

kernelbase

ntdll

rpcrt4

ucrtbase

ws2_32

generic