fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147

Sharing

Copy URL Twitter E-mail

General

Target
fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147
Size 149KB
Sample260808-ha681ssamd
SHA256 fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147
MD5 c75e15f0837473622fe098541c455668
SHA1 973b951a4b7e4768e530101ec5e5e82fb631b4f0
SHA512 3aeaab4ab39cf2def32b52246b44ee988249572e7e6c90e609807468339afc0f5206cab2ea3dfe630aa9debc9aefc6779935d51d7702b8ed37cad25376e6c781
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9Fs:hVj1K620mpOSxSoac55s9Fs
TLSH
T154E38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147

File Explorer

fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147

.dll 149KB

fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147

IMPHASH c48ce63c2b008e1462c0dba4cd71a18b
SHA256 fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147
MD5 c75e15f0837473622fe098541c455668
SHA1 973b951a4b7e4768e530101ec5e5e82fb631b4f0
SHA512 3aeaab4ab39cf2def32b52246b44ee988249572e7e6c90e609807468339afc0f5206cab2ea3dfe630aa9debc9aefc6779935d51d7702b8ed37cad25376e6c781
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9Fs:hVj1K620mpOSxSoac55s9Fs
TLSH
T154E38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcessHeap ExitProcess WriteConsoleW HeapAlloc CloseHandle CreateFileA HeapFree GetModuleFileNameA SwitchToThread ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InterlockedFlushSList RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetModuleFileNameW SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle GetFileType WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW SetStdHandle GetStringTypeW FlushFileBuffers WriteFile GetConsoleOutputCP CreateFileW HeapSize HeapReAlloc SetEndOfFile DecodePointer

advapi32

CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

Name

.text

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplh"

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplm"

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpla"

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpls"

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpld"

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplx"

Size

512B

Virtual Size

81B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fd2f9c5c515aad7cda238b1bc8d5444e9dfd787bfddf20cdf7aa67eb148c3147

kernel32

advapi32

generic