564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911

Sharing

Copy URL Twitter E-mail

General

Target
564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911
Size 170KB
Sample260812-dal6maxdlb
SHA256 564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911
MD5 394a4aa3af18a45bf3f5f2e32b211dec
SHA1 a330ac5710498470606dc20abbe8a10a702e7dd9
SHA512 c8d8e7aafa786684cd85d87b7bc787cbf2e23e44e89298995e0c21a7ad1d95d1de8cadf4953f69be8c37f25ade5239cfc4b8e82164edcf1c20fafa72e2f3e306
SSDEEP 3072:PT24HHP19rrszlOpl/o4B4rj2Yog7Opldg7dNuIXHXlxBb/q:PT24PfKlmlwCThgyplq7dz/
TLSH
T199048D95B7A510F8E5768239C8914616F77278210720DFEF03A817B69F236E19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911

File Explorer

564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911

.exe 170KB

564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911

IMPHASH 49ea033995c5831dc0b3677226f2d29f
SHA256 564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911
MD5 394a4aa3af18a45bf3f5f2e32b211dec
SHA1 a330ac5710498470606dc20abbe8a10a702e7dd9
SHA512 c8d8e7aafa786684cd85d87b7bc787cbf2e23e44e89298995e0c21a7ad1d95d1de8cadf4953f69be8c37f25ade5239cfc4b8e82164edcf1c20fafa72e2f3e306
SSDEEP 3072:PT24HHP19rrszlOpl/o4B4rj2Yog7Opldg7dNuIXHXlxBb/q:PT24PfKlmlwCThgyplq7dz/
TLSH
T199048D95B7A510F8E5768239C8914616F77278210720DFEF03A817B69F236E19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep InitializeCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW SetEndOfFile RtlUnwindEx GetLastError SetLastError DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW CompareStringW LCMapStringW GetProcessHeap GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW CloseHandle HeapSize HeapReAlloc WriteConsoleW

Name

.text

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text0

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data0

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gehcont

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

564c2a19e7b45fa9722ecb775ee7b86fc454101c4f12f4fb3bbcd3e8d4342911

kernel32

generic