36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2

General

Target
36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2
Size 144KB
Sample260808-vddr4aed95
SHA256 36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2
MD5 afea68e65c4d49a86092fb31de17da9a
SHA1 63eb0cdbe1bf2d65eb5a34c54f5c16c7f70be950
SHA512 8f7d64ffdf4a6308896a958fd03eed71b81f2aecc4225a639fb3efdd88610f3f9966d31b5394ae4d98c4e9ad714b7f772d32c3eadf853e10c8729e08926bf672
SSDEEP 3072:IwzvOYRt5YP/aKavT/DvbEvK9aobNI2B+hlsfni3YGByThXKBZkZN4GhQ2eRZh+m:ftiP/aK2h9H/B+
TLSH
T1FBE3C61276F8116DF0B36B30A8359B515ABAFC33DE21DB6E1A84166D1E30980DA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2

File Explorer

36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2

.exe 144KB

36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2

IMPHASH b696542cade53789c2cbed09ce287013
SHA256 36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2
MD5 afea68e65c4d49a86092fb31de17da9a
SHA1 63eb0cdbe1bf2d65eb5a34c54f5c16c7f70be950
SHA512 8f7d64ffdf4a6308896a958fd03eed71b81f2aecc4225a639fb3efdd88610f3f9966d31b5394ae4d98c4e9ad714b7f772d32c3eadf853e10c8729e08926bf672
SSDEEP 3072:IwzvOYRt5YP/aKavT/DvbEvK9aobNI2B+hlsfni3YGByThXKBZkZN4GhQ2eRZh+m:ftiP/aK2h9H/B+
TLSH
T1FBE3C61276F8116DF0B36B30A8359B515ABAFC33DE21DB6E1A84166D1E30980DA21F77
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

GoogleUpdate_unsigned.pdb

advapi32

RegOpenKeyExW

kernel32

SizeofResource HeapFree GetCommandLineW GetModuleFileNameW InitializeCriticalSectionAndSpinCount HeapSize GetLastError GetFileAttributesExW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection GetProcessHeap GetModuleHandleW FreeLibrary LoadLibraryExW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind EncodePointer ExitProcess GetModuleHandleExW GetStdHandle WriteFile FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetFileType WriteConsoleW

shell32

SHGetFolderPathW

user32

CharLowerBuffW

shlwapi

SHQueryValueExW PathAppendW PathRemoveFileSpecW

Sharing

General

Malware Config

Signatures

File Explorer

36771347ed3f238360fdf4e82799102c2cf1d23520ccbe92eef3af2dcb0888c2

advapi32

kernel32

shell32

user32

shlwapi

generic