c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451

Sharing

Copy URL Twitter E-mail

General

Target
c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451
Size 828KB
Sample260809-11mleawfmf
SHA256 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451
MD5 818d35216668b3de116345d0823be43d
SHA1 9c334e3e6ed1e7c6e8e464902f737cb7c5567865
SHA512 ac004fe0a08abf41538e86ee8633d1e8ae2faf7aac5957150fcb5022155ab3de2865175fe9e8308c6412aab76af8c1cc9f7c596655fd39cb4ef9d7c914007c3d
SSDEEP 12288:rXc80rGME48k1jRICeaRtMLJXcBPoPaIXkKbflK4cmbv8:rXF0rxEcRICea3MGIXkKB5bv
TLSH
T10C057B56F7A614F9E873C1388A636616FAB27C150730DBEB03905A6A6F237D09D3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451

File Explorer

c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451

.exe 828KB

c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451

IMPHASH 3f17d3c9c09c05970d4d6547fb8880ba
SHA256 c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451
MD5 818d35216668b3de116345d0823be43d
SHA1 9c334e3e6ed1e7c6e8e464902f737cb7c5567865
SHA512 ac004fe0a08abf41538e86ee8633d1e8ae2faf7aac5957150fcb5022155ab3de2865175fe9e8308c6412aab76af8c1cc9f7c596655fd39cb4ef9d7c914007c3d
SSDEEP 12288:rXc80rGME48k1jRICeaRtMLJXcBPoPaIXkKbflK4cmbv8:rXF0rxEcRICea3MGIXkKB5bv
TLSH
T10C057B56F7A614F9E873C1388A636616FAB27C150730DBEB03905A6A6F237D09D3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage LoadIconW LoadCursorW MessageBoxW SetWindowTextW UpdateWindow KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW GetMessageW

gdi32

SetBkMode DeleteObject CreateSolidBrush SetTextColor

comctl32

InitCommonControlsEx

shell32

ShellExecuteW

kernel32

FlushFileBuffers GetProcessHeap LCMapStringW ReadFile LoadLibraryExW VirtualProtect ReadConsoleW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile FlsGetValue CreateFileW DeleteFileW FindClose FindFirstFileW GetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError Sleep TerminateProcess CreateProcessW OpenProcess GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW MoveFileExW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

Name

.text

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

662KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c105d5d02f272d465f8c71dc2006c0fbfffab943f47b067072fc158a50a0e451

user32

gdi32

comctl32

shell32

kernel32

generic