41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2

Sharing

Copy URL Twitter E-mail

General

Target
41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2
Size 468KB
Sample260812-jxxtjasalg
SHA256 41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2
MD5 b8be12d16c79e5d199afa0a0e2eb3620
SHA1 15cfa9832216e61698976d0a45b7b98ec7b57247
SHA512 adff5e54a0f0ebc9b280361c20216f65d9f6d05b1092c6cf50745a237c44f65c0caf4f6a42b69f4d91cf4c9629a08e88115c3db72532f408fad03b0a11a94d03
SSDEEP 6144:Zs8App40PlAOlNYfb2vljB1HlkuwCr4BY+JyFNjhy3+Z3oAOpCvQIrLrMsEmS8CF:2ppPlAOS2vr1HyIxFNWW47CjrrS8K
TLSH
T140A49E12B691D077D47201314A76DB77877DB8300B244AEF63D41AAA9F323C1AE36F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2

File Explorer

41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2

.exe 468KB

41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2

IMPHASH c7211fa923558778ff54eac3413ba9c8
SHA256 41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2
MD5 b8be12d16c79e5d199afa0a0e2eb3620
SHA1 15cfa9832216e61698976d0a45b7b98ec7b57247
SHA512 adff5e54a0f0ebc9b280361c20216f65d9f6d05b1092c6cf50745a237c44f65c0caf4f6a42b69f4d91cf4c9629a08e88115c3db72532f408fad03b0a11a94d03
SSDEEP 6144:Zs8App40PlAOlNYfb2vljB1HlkuwCr4BY+JyFNjhy3+Z3oAOpCvQIrLrMsEmS8CF:2ppPlAOS2vr1HyIxFNWW47CjrrS8K
TLSH
T140A49E12B691D077D47201314A76DB77877DB8300B244AEF63D41AAA9F323C1AE36F66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetExitCodeProcess SetConsoleCtrlHandler MoveFileA MoveFileExA WritePrivateProfileStringA SetFileAttributesA DeleteCriticalSection ExitProcess SetThreadExecutionState CreateProcessA GetPrivateProfileIntA GetPrivateProfileStringA SetEndOfFile HeapSize CreateFileW Process32Next GetFileAttributesA CreateToolhelp32Snapshot InitializeCriticalSection LeaveCriticalSection TerminateProcess EnterCriticalSection Process32First CreateEventA CreateThread SetEvent Sleep WaitForSingleObject CreateDirectoryA GetCurrentProcessId LocalFree CloseHandle DeleteFileA CreateFileA GetLastError CopyFileA ProcessIdToSessionId MultiByteToWideChar GetEnvironmentVariableA GetCurrentProcess GetModuleFileNameA IsBadReadPtr FreeLibrary GetProcessHeap GetProcAddress HeapAlloc GetNativeSystemInfo LoadLibraryA VirtualAlloc VirtualFree SetLastError HeapFree WTSGetActiveConsoleSessionId VirtualProtect SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW WriteConsoleW GetFileSizeEx HeapReAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA GetModuleFileNameW WriteFile InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetCurrentThreadId WideCharToMultiByte WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ReadFile ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle

user32

CharLowerA

advapi32

AdjustTokenPrivileges CryptAcquireContextA RegCloseKey ConvertSidToStringSidA RegQueryValueExA LookupPrivilegeValueA RegCreateKeyExA CryptCreateHash CryptHashData RegSetValueExA CryptDestroyHash RegOpenKeyExA CryptGetHashParam CryptReleaseContext CreateProcessAsUserA SetTokenInformation DuplicateTokenEx CreateServiceA StartServiceCtrlDispatcherA QueryServiceStatus CloseServiceHandle QueryServiceConfigA SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA DeleteService ControlService StartServiceA ChangeServiceConfig2A QueryServiceStatusEx OpenServiceA EqualSid AllocateAndInitializeSid GetUserNameA ConvertStringSidToSidW OpenProcessToken FreeSid CheckTokenMembership GetTokenInformation

shell32

ShellExecuteExA ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathFileExistsA

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsA

ws2_32

setsockopt send recv freeaddrinfo inet_ntop socket WSAGetLastError htons inet_addr WSAStartup getaddrinfo inet_pton closesocket WSACleanup connect

Name

.text

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

41a83034f1fff238a365bf2a0d2f66a71c347d674761352307b6e15eb4e6dcc2

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

shlwapi

wtsapi32

ws2_32

generic