de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e

Sharing

Copy URL Twitter E-mail

General

Target
de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e
Size 116KB
Sample260809-3blc6axcne
SHA256 de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e
MD5 eb2061811ad7ecb054ac82a339694019
SHA1 3353a5b713ea7c6aa409576bd935857096aaac1b
SHA512 e2854f00075b8b896dfe4bcfd280935cb2ff638e1922a79a2d419fba49006f6b001dc7bf6406f51c79609e6319c78db51dbbaeb1d7568d564175d09e4baf1ecc
SSDEEP 1536:MoSPLhCGk+UN11BWnqxdhvzHDKY07LuBMy3RFPFkoVd:f0LIF71wsY2Wy3RFOY
TLSH
T101C3D624B7DA49A4F5B25B306DB6C7A72A3AFC31FA35DF2E9200155E0C309B2D855F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e

File Explorer

de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e

.exe 116KB

de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e

IMPHASH 7574b1cf845291b45edecacebb58a8be
SHA256 de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e
MD5 eb2061811ad7ecb054ac82a339694019
SHA1 3353a5b713ea7c6aa409576bd935857096aaac1b
SHA512 e2854f00075b8b896dfe4bcfd280935cb2ff638e1922a79a2d419fba49006f6b001dc7bf6406f51c79609e6319c78db51dbbaeb1d7568d564175d09e4baf1ecc
SSDEEP 1536:MoSPLhCGk+UN11BWnqxdhvzHDKY07LuBMy3RFPFkoVd:f0LIF71wsY2Wy3RFOY
TLSH
T101C3D624B7DA49A4F5B25B306DB6C7A72A3AFC31FA35DF2E9200155E0C309B2D855F12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetModuleHandleA GetPrivateProfileSectionW GetProcAddress IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileA CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent TerminateProcess UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtCreateEvent NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetVersion RtlInitUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _putenv _read _set_app_type _strdup _stricmp _wgetenv _wopen _write exit free fwrite getenv memmove memset qsort strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcsncmp wcsstr

ws2_32

freeaddrinfo getaddrinfo gethostname

Name

.text

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

220B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

de4fe25f45067c624abd1533858f14f9846f5600c11cf96d1c2128cc3cced19e

advapi32

kernel32

kernelbase

ntdll

ucrtbase

ws2_32

generic