1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69

Sharing

Copy URL Twitter E-mail

General

Target
1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69
Size 452KB
Sample260808-r6w8csszaz
SHA256 1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69
MD5 8214b16188bbaa61d60b680be799489d
SHA1 614e7b45fceaff12778df28fb0f7cbc77c95d4a8
SHA512 9b680e1fea65e3dc3a45e5bf825c8684a411522f3f6746e37c1dd74e087906ffe579b3b5f7bbc733c90000304091a2bbb64a9fceefc2779a57dd5614c19d3652
SSDEEP 12288:ukAlvdkTeceMf8/tem9g+crrK1s/jfm3eT:ukAlFkypMf8/tev7rK+/jfN
TLSH
T152A43A41FBC384B1C94688304866E32FD63C6E588B15CD97E7A07A9AED731D247396CB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69

File Explorer

1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69

.exe 452KB

1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69

IMPHASH b4b1ea23f7571e37d44616dfda3b9baf
SHA256 1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69
MD5 8214b16188bbaa61d60b680be799489d
SHA1 614e7b45fceaff12778df28fb0f7cbc77c95d4a8
SHA512 9b680e1fea65e3dc3a45e5bf825c8684a411522f3f6746e37c1dd74e087906ffe579b3b5f7bbc733c90000304091a2bbb64a9fceefc2779a57dd5614c19d3652
SSDEEP 12288:ukAlvdkTeceMf8/tem9g+crrK1s/jfm3eT:ukAlFkypMf8/tev7rK+/jfN
TLSH
T152A43A41FBC384B1C94688304866E32FD63C6E588B15CD97E7A07A9AED731D247396CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

215648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winhttp

WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen

shell32

CommandLineToArgvW

kernel32

FreeLibraryAndExitThread HeapSize SetEndOfFile GetProcessHeap GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP GetModuleHandleA GetCurrentProcess FlushFileBuffers GetLastError GetCommandLineW WideCharToMultiByte LocalFree RtlUnwind IsDebuggerPresent RaiseException LoadLibraryW GetProcAddress FreeLibrary GetConsoleScreenBufferInfo GetConsoleOutputCP WriteFile MultiByteToWideChar InitializeCriticalSection QueryPerformanceFrequency GetCurrentThreadId GetCurrentThread DuplicateHandle EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FormatMessageW CloseHandle ResumeThread WaitForSingleObject GetExitCodeThread Sleep SwitchToThread LoadLibraryA GetStdHandle TryEnterCriticalSection GetEnvironmentVariableA RtlCaptureContext VirtualAlloc VirtualFree GetSystemInfo QueryPerformanceCounter SetEvent GlobalMemoryStatusEx CreateEventW ResetEvent OpenThread TerminateThread SuspendThread GetThreadContext GetModuleHandleExW VerSetConditionMask VerifyVersionInfoW DecodePointer GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent IsValidCodePage InitializeCriticalSectionEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer SetStdHandle GetFileType ReadFile GetModuleFileNameW WriteConsoleW ExitProcess TerminateProcess CreateThread ExitThread GetCommandLineA UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetConsoleMode HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW ReadConsoleW CreateFileW HeapReAlloc FindClose FindFirstFileExW FindNextFileW

Name

.text

Size

332KB

Virtual Size

331KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.minfo

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dp

Size

512B

Virtual Size

452B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tp

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

._deh

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1c9979cf7be20c81d3ed326f6129935684759b26353fc39948af419bd8e28e69

winhttp

shell32

kernel32

generic