4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c

General

Target
4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c
Size 84KB
Sample260807-lee7wafa57
SHA256 4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c
MD5 5a10bc6706f3b86cb1a2ca694d350e72
SHA1 dc5856051522b045a0d6619711df86c43c704a3d
SHA512 f5d5439d63af71cfce2477cae8c9d48147c48381243548efa1a8b7397b12388c3d1cf526dc70bb3329c5c4fe3bff9df4d1033b2f0b85261c05363a498dbf7bd2
SSDEEP 1536:465hTxoXqGfoe+bBo6MV+KUDlWoF0uTnTN2MgaPybY0d0zn52sW5cdwU5M4+:h8qGfoC6BK+F08dgaPyT4n5wU5M4+
TLSH
T1C7836B40B591C139ECBE183A4828DA764B3EB810DFD0DDDB379506AD0E342D0AF3696B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c

File Explorer

4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c

.dll 84KB

4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c

IMPHASH c85377cbc7e5e281e5c5221350a8f712
SHA256 4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c
MD5 5a10bc6706f3b86cb1a2ca694d350e72
SHA1 dc5856051522b045a0d6619711df86c43c704a3d
SHA512 f5d5439d63af71cfce2477cae8c9d48147c48381243548efa1a8b7397b12388c3d1cf526dc70bb3329c5c4fe3bff9df4d1033b2f0b85261c05363a498dbf7bd2
SSDEEP 1536:465hTxoXqGfoe+bBo6MV+KUDlWoF0uTnTN2MgaPybY0d0zn52sW5cdwU5M4+:h8qGfoC6BK+F08dgaPyT4n5wU5M4+
TLSH
T1C7836B40B591C139ECBE183A4828DA764B3EB810DFD0DDDB379506AD0E342D0AF3696B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptImportKey CryptDecrypt CryptAcquireContextW

kernel32

HeapAlloc HeapFree GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent WriteConsoleW InterlockedFlushSList RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle DecodePointer

Sharing

General

Malware Config

Signatures

File Explorer

4d48f949398f26a283a4294b2c968a89106139264d0b4a66fa17e46a2bc2d59c

advapi32

kernel32

generic