94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef

Sharing

Copy URL Twitter E-mail

General

Target
94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef
Size 1.8MB
Sample260809-lz81paywhy
SHA256 94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef
MD5 dbd8e9f3d1f2377bba84b47e399be203
SHA1 27e197277a5728f3e07ce44cbb792b58b7ec417d
SHA512 992ea65aa346e123c73153f6d58ff0a6c104aa9728d934f8954b0001e8a8588913ce24ba5faf09b9afa1db3d4988d00de0ee1be4471bde53d8527a2b577e6842
SSDEEP 49152:g0Qc74awG+7cLt0di7SS7lrk0MlLTBFPFGNK/b337CWCu1:HQc7HnlrMlPBFtMibO
TLSH
T19495CF50B642D033D66501B16D2EEB66A93DBC361F204EDBA3D43ABF68754C14E32F4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef

File Explorer

94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef

.exe 1.8MB

94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef

IMPHASH 966874b877b27ef241fb5100f6504120
SHA256 94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef
MD5 dbd8e9f3d1f2377bba84b47e399be203
SHA1 27e197277a5728f3e07ce44cbb792b58b7ec417d
SHA512 992ea65aa346e123c73153f6d58ff0a6c104aa9728d934f8954b0001e8a8588913ce24ba5faf09b9afa1db3d4988d00de0ee1be4471bde53d8527a2b577e6842
SSDEEP 49152:g0Qc74awG+7cLt0di7SS7lrk0MlLTBFPFGNK/b337CWCu1:HQc7HnlrMlPBFtMibO
TLSH
T19495CF50B642D033D66501B16D2EEB66A93DBC361F204EDBA3D43ABF68754C14E32F4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

498503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Source Code\imageUSB\Release\imageUSB.pdb

shlwapi

PathCombineW PathFindExtensionW PathRemoveExtensionW PathStripToRootW PathFindFileNameW PathRemoveFileSpecW

comctl32

ImageList_ReplaceIcon ImageList_Create ImageList_Destroy

kernel32

WideCharToMultiByte GetModuleFileNameW LoadLibraryW FreeLibrary LoadLibraryExW CreateDirectoryW SetLastError SetFileTime CreateFileW GetCurrentThreadId SetFileAttributesW DeleteFileW CloseHandle GetProcAddress GetCurrentProcessId GetModuleHandleW GetTickCount FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetModuleHandleA GetLogicalDriveStringsW SetFilePointer SetEndOfFile GetFileSize VirtualFree VirtualAlloc GetVolumeInformationW GetDiskFreeSpaceW DeviceIoControl GetDiskFreeSpaceExW GetDriveTypeW QueryPerformanceFrequency QueryPerformanceCounter GetFileSizeEx FindFirstVolumeW GetCommandLineW CreateMutexW InitializeCriticalSectionEx WaitForSingleObject LocalAlloc ReleaseMutex GetExitCodeThread Sleep FormatMessageW CreateThread DecodePointer SetFilePointerEx LocalFree GetTimeFormatW GetLastError VerSetConditionMask FindVolumeClose GetVolumePathNamesForVolumeNameW VerifyVersionInfoW FindNextVolumeW GetDateFormatW TerminateThread SetDllDirectoryW GetCurrentThread SetUnhandledExceptionFilter AddVectoredExceptionHandler RemoveVectoredExceptionHandler RtlCaptureContext GetCurrentProcess GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode HeapQueryInformation HeapSize HeapReAlloc GetFileType HeapAlloc HeapFree SetConsoleCtrlHandler ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind OutputDebugStringW WaitForSingleObjectEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetFileInformationByHandle WriteFile GetStdHandle ReadFile MultiByteToWideChar WriteConsoleW GetProcessHeap SetEnvironmentVariableW DeleteCriticalSection FreeEnvironmentStringsW GetLocalTime IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetCPInfo CompareStringEx GetSystemTimeAsFileTime GetStringTypeW InitOnceExecuteOnce TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive RaiseException EncodePointer LCMapStringEx LeaveCriticalSection EnterCriticalSection GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW

user32

InvalidateRect EnableWindow GetParent GetWindowTextW PostQuitMessage KillTimer GetDlgItem GetClientRect SetWindowLongW LoadIconW TranslateMessage CharUpperW ReleaseDC SystemParametersInfoW DialogBoxParamW CreateWindowExW MoveWindow GetWindowLongW GetMessageW CreateDialogParamW DefWindowProcW GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos MessageBoxW MonitorFromWindow GetWindowTextLengthW ScreenToClient SendMessageW EndDialog GetSystemMetrics SetWindowTextW MessageBeep ShowWindow DispatchMessageW SetTimer IsDialogMessageW DestroyIcon GetMonitorInfoW GetDlgCtrlID SetDlgItemTextW SendDlgItemMessageW MessageBoxA IsWindowEnabled

gdi32

SelectObject CreateFontW GetStockObject SetTextColor CreatePen Rectangle SetBkColor DeleteObject CreateSolidBrush

comdlg32

GetSaveFileNameW GetOpenFileNameW

shell32

CommandLineToArgvW ShellExecuteW DragAcceptFiles DragQueryFileW

ole32

StringFromGUID2 CoInitialize CoInitializeEx CLSIDFromString CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoCreateGuid CoUninitialize

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

dbghelp

SymGetModuleBase64 SymFunctionTableAccess64 SymCleanup StackWalk64 SymGetLineFromAddr64 SymFromAddr SymInitialize

Name

.text

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

918KB

Virtual Size

918KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

94338100d5f43da6a7388b00b1e8a2645e1ff9686b194f46aca6d82aa8c87eef

shlwapi

comctl32

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

dbghelp

generic