aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17

General

Target
aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17
Size 344KB
Sample260811-vcsvmatwgw
SHA256 aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17
MD5 9994819e9d9bc5571366215afee331e7
SHA1 59ca53173a88e8a897aba28472bbf3243b30214e
SHA512 774d5bed9141f5103c8cfd0bb9bb6d78161c0a04f975eb8ce5bf631721ed01a216a75ee97a7034007d0903a6e2bc81f72956b5b51b3a48f61e7d0548ab5d3689
SSDEEP 3072:RNGYs/VCGrBuWPCV8zdMDbh/CBGrw3Bv1rWoONtDRDkUZEw:RgL/drBuPV8zdMDbh/CBGE3Pr8DSw
TLSH
T13A741B23D621C4A7E02C11F122BB87793DB467721CB186ABDFD0CDF06D616718B82A1E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17

File Explorer

aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17

.dll 344KB

aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17

IMPHASH 26ce45649fda3b627e5ec8c7c01508fa
SHA256 aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17
MD5 9994819e9d9bc5571366215afee331e7
SHA1 59ca53173a88e8a897aba28472bbf3243b30214e
SHA512 774d5bed9141f5103c8cfd0bb9bb6d78161c0a04f975eb8ce5bf631721ed01a216a75ee97a7034007d0903a6e2bc81f72956b5b51b3a48f61e7d0548ab5d3689
SSDEEP 3072:RNGYs/VCGrBuWPCV8zdMDbh/CBGrw3Bv1rWoONtDRDkUZEw:RgL/drBuPV8zdMDbh/CBGE3Pr8DSw
TLSH
T13A741B23D621C4A7E02C11F122BB87793DB467721CB186ABDFD0CDF06D616718B82A1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

245753

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OpenFileMappingA CreateFileMappingA MapViewOfFile UnmapViewOfFile CreateWaitableTimerA SetWaitableTimer IsDebuggerPresent VirtualAlloc VirtualFree CloseHandle VirtualProtect GetFileAttributesA CreateToolhelp32Snapshot Module32Next Process32First Process32Next GetCurrentProcessId CreateMutexA OpenEventA CreateEventA GetProcessHeap GetModuleHandleA ExitProcess HeapAlloc HeapReAlloc HeapFree IsBadReadPtr Sleep GetCommandLineA GetModuleFileNameA FreeLibrary CreateFileA LoadLibraryA LCMapStringA FlushFileBuffers SetStdHandle IsBadCodePtr SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA GetOEMCP GetACP GetCPInfo LCMapStringW MultiByteToWideChar SetFilePointer RaiseException IsBadWritePtr WriteFile GetDiskFreeSpaceExA GetProcAddress GlobalMemoryStatusEx HeapCreate HeapDestroy GetVersionExA GetTickCount InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetVersion RtlUnwind InterlockedDecrement InterlockedIncrement TerminateProcess GetCurrentProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetLastError SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA

user32

IsWindowVisible GetWindowTextA GetClassNameA CreateWindowStationA GetWindowThreadProcessId MessageBoxA DispatchMessageA TranslateMessage GetMessageA PeekMessageA wsprintfA

shell32

ShellExecuteA

ws2_32

WSAStartup socket htons inet_addr connect gethostbyname send recv getsockname ntohs WSAAsyncSelect select WSACleanup closesocket

Sharing

General

Malware Config

Signatures

File Explorer

aada70f147f46a1bb8029ac65bff8430f9f131e907161d6daa013d81d3c80c17

kernel32

user32

shell32

ws2_32

generic