1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82

Sharing

Copy URL Twitter E-mail

General

Target
1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82
Size 498KB
Sample260810-ravpnagf48
SHA256 1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82
MD5 f30943cafa23f679db7fa3155116c452
SHA1 cace16bb90c6e72d976338b32aac199e840b4400
SHA512 ae50ecdbf8a103916a7d6284e0a6ecf865e820180bd0d353b253cd38712e86ad62dca5c4fe8434d4da3a7098efdeacd8dd8a2dcd53ecaaa9033e7e26006aa65d
SSDEEP 6144:tmVg+br4CqwXHnmT5u82m2/q7PFHCpLkUJb0v74ikxpkY1EOJAOD+nCaxxUM:AIiHmT0147PFHu9s74iwyOJjaxxUM
TLSH
T1FEB459007792C0B1C5D129B24E6BA65605E9BF303B6449FFF3A4392D1E305D2BE37A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82

File Explorer

1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82

.exe 498KB

1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82

IMPHASH ac7a54e32a0e1ed8213d230e7c631844
SHA256 1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82
MD5 f30943cafa23f679db7fa3155116c452
SHA1 cace16bb90c6e72d976338b32aac199e840b4400
SHA512 ae50ecdbf8a103916a7d6284e0a6ecf865e820180bd0d353b253cd38712e86ad62dca5c4fe8434d4da3a7098efdeacd8dd8a2dcd53ecaaa9033e7e26006aa65d
SSDEEP 6144:tmVg+br4CqwXHnmT5u82m2/q7PFHCpLkUJb0v74ikxpkY1EOJAOD+nCaxxUM:AIiHmT0147PFHu9s74iwyOJjaxxUM
TLSH
T1FEB459007792C0B1C5D129B24E6BA65605E9BF303B6449FFF3A4392D1E305D2BE37A5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

232230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetVersion VirtualAlloc VirtualFree GetModuleHandleW GetProcAddress GetStdHandle GetFileInformationByHandle ReadFile WriteFile GetSystemTimeAsFileTime GetModuleHandleA GlobalMemoryStatus GetProcessAffinityMask CreateFileW SetFileTime SetLastError FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetCurrentDirectoryW CreateDirectoryW DeleteFileW RemoveDirectoryW SetFileAttributesW GetTempPathW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameW LoadLibraryExW MultiByteToWideChar WideCharToMultiByte LeaveCriticalSection EnterCriticalSection SetThreadAffinityMask ResumeThread CreateSemaphoreW CreateEventW WaitForSingleObject ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection CloseHandle LoadLibraryW FreeLibrary GetTickCount GetLocalTime GetSystemTime GetSystemInfo GetCurrentProcess Sleep DeleteCriticalSection InitializeCriticalSectionEx IsDebuggerPresent OutputDebugStringW GetFullPathNameW TerminateProcess GetStartupInfoW FindResourceExW LoadResource LockResource SizeofResource FindResourceW lstrlenW MoveFileExW FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter InitializeSListHead RtlUnwind EncodePointer VirtualQuery InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess LCMapStringW GetFileType GetConsoleOutputCP GetConsoleMode SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW WriteConsoleW GetProcessHeap IsProcessorFeaturePresent HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetErrorMode GetLastError RaiseException DecodePointer

user32

DefWindowProcW CharUpperW

ole32

CoTaskMemFree CoCreateGuid StringFromCLSID CoUninitialize CoInitialize

oleaut32

SysAllocStringLen VariantClear SysStringLen VariantCopy SysFreeString

shlwapi

PathAppendW PathCombineW PathIsDirectoryW PathFileExistsW

shell32

SHCreateDirectoryExW

Sharing

General

Malware Config

Signatures

File Explorer

1ee893479c0d7c1cd2eed5f6d05b75bf3a20be4265500625dcee011b8ae17e82

kernel32

user32

ole32

oleaut32

shlwapi

shell32

generic