8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539

Sharing

Copy URL Twitter E-mail

General

Target
8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539
Size 149KB
Sample260815-3eqgaavfrd
SHA256 8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539
MD5 abb40daca9b1ef7370310022bbb894b9
SHA1 3a5d4ba20a014c16dbf412231b21978238e1b463
SHA512 c1306c076cd97d3d675e046580147e4893e3890754975a26581c1183e5e1853986bbd03e39b8b09ac1bb837b2fdcfa7459f3164f4243c36af35ccd1b6d715d19
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9Fq:hVj1K620mpOSxSoac55s9Fq
TLSH
T1F6E38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539

File Explorer

8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539

.dll 149KB

8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539

IMPHASH c48ce63c2b008e1462c0dba4cd71a18b
SHA256 8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539
MD5 abb40daca9b1ef7370310022bbb894b9
SHA1 3a5d4ba20a014c16dbf412231b21978238e1b463
SHA512 c1306c076cd97d3d675e046580147e4893e3890754975a26581c1183e5e1853986bbd03e39b8b09ac1bb837b2fdcfa7459f3164f4243c36af35ccd1b6d715d19
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9Fq:hVj1K620mpOSxSoac55s9Fq
TLSH
T1F6E38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcessHeap ExitProcess WriteConsoleW HeapAlloc CloseHandle CreateFileA HeapFree GetModuleFileNameA SwitchToThread ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InterlockedFlushSList RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetModuleFileNameW SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle GetFileType WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW SetStdHandle GetStringTypeW FlushFileBuffers WriteFile GetConsoleOutputCP CreateFileW HeapSize HeapReAlloc SetEndOfFile DecodePointer

advapi32

CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

Name

.text

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplh"

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplm"

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpla"

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpls"

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpld"

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplx"

Size

512B

Virtual Size

81B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8d9e83653880b5376292538424a894537596f1e9218e584866b8cf64fcf60539

kernel32

advapi32

generic