4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3

Sharing

Copy URL Twitter E-mail

General

Target
4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3
Size 2.3MB
Sample260814-kvzqsage67
SHA256 4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3
MD5 cf0c9a27400473c9a6d77cb836d3e731
SHA1 b801258cca745256c2f065574a116c7d2d3eae50
SHA512 78bb49aa4fa11d0150a8fa6bc7f1dafb98f3772f490a71ea2b1b4c6a7c9d9a81a1e4d58dc5a28c3d4336aecc9f9b3bd65ae829f3a38de637b2949b2d10d9a340
SSDEEP 24576:tWjWUl+viHmR4hVBCH8J+bYe/OamMRL53j5s01ZZWXWuK2uSXvEOeh4Da6fd4xcJ:gjxltH1iLtdRZZwWj2hEOUMhVOcJ
TLSH
T154B5E042F9830083F7D365B02B3AD9A5D4296AB3BB181CCB4058819495FDDDF96B363B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3

File Explorer

4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3

.exe 2.3MB

4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3

IMPHASH be40317f77365bdf4dbd1877eee6bf25
SHA256 4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3
MD5 cf0c9a27400473c9a6d77cb836d3e731
SHA1 b801258cca745256c2f065574a116c7d2d3eae50
SHA512 78bb49aa4fa11d0150a8fa6bc7f1dafb98f3772f490a71ea2b1b4c6a7c9d9a81a1e4d58dc5a28c3d4336aecc9f9b3bd65ae829f3a38de637b2949b2d10d9a340
SSDEEP 24576:tWjWUl+viHmR4hVBCH8J+bYe/OamMRL53j5s01ZZWXWuK2uSXvEOeh4Da6fd4xcJ:gjxltH1iLtdRZZwWj2hEOUMhVOcJ
TLSH
T154B5E042F9830083F7D365B02B3AD9A5D4296AB3BB181CCB4058819495FDDDF96B363B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1507186

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateDirectoryW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

CharUpperBuffW CloseClipboard CreateWindowExW DefWindowProcW DispatchMessageW EmptyClipboard GetClipboardData GetMessageW LockWorkStation MessageBeep MessageBoxW OpenClipboard PostQuitMessage RegisterClassExW RegisterHotKey SetClipboardData TranslateMessage

shell32

SHBrowseForFolderW SHFileOperationW SHGetFolderPathW SHGetKnownFolderPath SHGetPathFromIDListW ShellExecuteW

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

comctl32

InitCommonControlsEx

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.seh

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

4c085cb79516494946428cc4466f0df1b55caeb3c394a78c6af735231b1288d3

kernel32

user32

shell32

advapi32

ole32

comctl32

generic