6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988

General

Target
6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988
Size 112KB
Sample260808-d5pj8szalg
SHA256 6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988
MD5 25a8b2900e3138d144fb142a306a9efa
SHA1 e09172a278047f40b5960a9dae4cc95a76b408f1
SHA512 bddb82af532e509288fd1c98d74089c6f53598a617ec28085cc8cb9da43c9003fae8885babdfde48227d3ce4c498e84817286d661ff9e13c6fa6dfb1fff5cb58
SSDEEP 3072:PZNdlaJHiPXwHvDxHId2nm19ZW7FaD3Bw1Lpd1t3/1hEx:PZNdcCPgL5hm1947EVk1Y
TLSH
T16DB34A5B67E900BBE176D239C8934A42D7B2B81147609FEF43A40A5A5F233D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988

File Explorer

6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988

.dll 112KB

6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988

IMPHASH 053a27affe248c148c40820c5cabd329
SHA256 6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988
MD5 25a8b2900e3138d144fb142a306a9efa
SHA1 e09172a278047f40b5960a9dae4cc95a76b408f1
SHA512 bddb82af532e509288fd1c98d74089c6f53598a617ec28085cc8cb9da43c9003fae8885babdfde48227d3ce4c498e84817286d661ff9e13c6fa6dfb1fff5cb58
SSDEEP 3072:PZNdlaJHiPXwHvDxHId2nm19ZW7FaD3Bw1Lpd1t3/1hEx:PZNdcCPgL5hm1947EVk1Y
TLSH
T16DB34A5B67E900BBE176D239C8934A42D7B2B81147609FEF43A40A5A5F233D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW GetFileSizeEx ReadFile SetFilePointer SetFilePointerEx WriteFile CloseHandle GetLastError SetEvent CreateEventW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess CreateThread GetCurrentThreadId OpenThread SuspendThread OpenProcess GetLocalTime VirtualProtect DisableThreadLibraryCalls GetModuleFileNameW GetModuleHandleW GetProcAddress lstrcmpA lstrcmpiA lstrcmpiW lstrcpynW lstrcatW lstrlenA lstrlenW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryW lstrcpynA WriteConsoleW GetConsoleMode RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle GetConsoleOutputCP

user32

wsprintfA CharLowerW

Name

.text

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6f44b515b7a2ffa8048f10cc886c8b9894f72a4ecbc178fb22bac230cc0e6988

kernel32

user32

generic