7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4

Sharing

Copy URL Twitter E-mail

General

Target
7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4
Size 3.6MB
Sample260808-yleadacr3z
SHA256 7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4
MD5 25940fc940f46330203632d8050b2ede
SHA1 7a5aec46f3d981893a1251ff5104eb59e9e90db1
SHA512 e281cb35325c24b13457f159a19008dcdd12806edca789137fc5e0aacb2bf9a889aff4ab0a2250636a0a4d7d333a28a295b02640ac772e92e8b24d7c0d057399
SSDEEP 49152:7sbr1yKZ++uGmIAStLTvW5fDl2BikOABJ8vGsXRtrtwkorSZ9z2nTz3NDfATJi6W:mIIAStLTvyR2BiXsAKDfAl4m
TLSH
T1F9067DCBFD33C257C298A1B553CC97ECF95C44284A9868B11398FAF17422F7862995CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4

File Explorer

7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4

.exe 3.6MB

7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4

IMPHASH 82d1602104af427feaeed206c0b12057
SHA256 7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4
MD5 25940fc940f46330203632d8050b2ede
SHA1 7a5aec46f3d981893a1251ff5104eb59e9e90db1
SHA512 e281cb35325c24b13457f159a19008dcdd12806edca789137fc5e0aacb2bf9a889aff4ab0a2250636a0a4d7d333a28a295b02640ac772e92e8b24d7c0d057399
SSDEEP 49152:7sbr1yKZ++uGmIAStLTvW5fDl2BikOABJ8vGsXRtrtwkorSZ9z2nTz3NDfATJi6W:mIIAStLTvyR2BiXsAKDfAl4m
TLSH
T1F9067DCBFD33C257C298A1B553CC97ECF95C44284A9868B11398FAF17422F7862995CE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LockResource LoadResource FindResourceW GetTickCount LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess GetStdHandle FindClose MultiByteToWideChar GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW WideCharToMultiByte VirtualQuery SetEvent CreateThread ResetEvent GetLocalTime GetSystemTimeAsFileTime lstrcmpiW LoadLibraryExW WriteConsoleW FlushFileBuffers GetStringTypeW InitializeCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RtlPcToFileHeader RtlUnwindEx InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringW SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc HeapFree TryEnterCriticalSection GetProcessHandleCount TerminateProcess OpenProcess GetCurrentProcessId WriteFile EnterCriticalSection LeaveCriticalSection RaiseException GetCurrentThreadId GetModuleHandleW IsDebuggerPresent FreeResource CreateEventW GetModuleFileNameW Sleep CloseHandle CreateFileW ExitProcess GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount SetStdHandle

user32

TranslateMessage MessageBoxW GetMessageW DefWindowProcW DispatchMessageW PeekMessageW ReleaseDC DestroyWindow GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW GetWindowLongPtrW SendMessageW CharNextW MonitorFromWindow WaitForInputIdle

gdi32

SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GetDeviceCaps DeleteDC GetObjectW DeleteObject

advapi32

RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegCloseKey

shell32

ShellExecuteW SHGetSpecialFolderPathW

ole32

CoUninitialize CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoInitializeEx CreateStreamOnHGlobal

oleaut32

VarUI4FromStr SystemTimeToVariantTime VariantTimeToSystemTime

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked InitCommonControlsEx

ws2_32

WSACleanup

gdiplus

GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipGetImagePixelFormat GdiplusShutdown GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImageWidth GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImageHeight GdiplusStartup GdipFree GdipDrawImageRectI

Name

.text

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7dab678c842a56ebeef699d1d7c3e0171f44c9ffc3075f621c3c3202ae2e34a4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic