6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f

Sharing

Copy URL Twitter E-mail

General

Target
6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f
Size 2.5MB
Sample260815-k55psahn4t
SHA256 6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f
MD5 684341d166fbe39751a7f3462f80ae04
SHA1 84342af98378f44ed4f7dbda115abf78c15706ba
SHA512 7759b2866c4747eec0fd91354c2c0eaa5a0769e2cecfc2b35c8d353cc11f91e10c98b5fbd122ab73693eb2ac3390853962a86e58c7dcb8b78b0849498342aaa6
SSDEEP 49152:9aCroZlUdmIQNh+PVwnZ5O5+9J39kuxvfuojbi4humGTWXa1fQxUCxtbN:0Mo2mhNc0HO5eSWvf7bhGT11NkbN
TLSH
T19FC53391C8BCF68BFB26C9336666EEACCFB17CA9495380C6497F3CA4D91C4C19350691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f

File Explorer

6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f

.dll 2.5MB

6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f

IMPHASH baa93d47220682c04d92f7797d9224ce
SHA256 6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f
MD5 684341d166fbe39751a7f3462f80ae04
SHA1 84342af98378f44ed4f7dbda115abf78c15706ba
SHA512 7759b2866c4747eec0fd91354c2c0eaa5a0769e2cecfc2b35c8d353cc11f91e10c98b5fbd122ab73693eb2ac3390853962a86e58c7dcb8b78b0849498342aaa6
SSDEEP 49152:9aCroZlUdmIQNh+PVwnZ5O5+9J39kuxvfuojbi4humGTWXa1fQxUCxtbN:0Mo2mhNc0HO5eSWvf7bhGT11NkbN
TLSH
T19FC53391C8BCF68BFB26C9336666EEACCFB17CA9495380C6497F3CA4D91C4C19350691
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7069696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\Code2\CLDShow_11025\Output\Release_NonRemix\CLDShowX.pdb

Name

Size

709KB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

viczkyxb

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

rbnrgvvi

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taggant

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=4, id=199, version=41118,

count=4, id=125, productName=VS2005 build 50727, version=50727,

count=41, productName=Unmarked objects (old),

count=2, id=206, productName=VS2012 UPD4 build 61030, version=61030,

count=6, id=207, version=61219,

count=4, id=203, version=50929,

count=8, id=205, version=50929,

count=13, id=206, version=50929,

count=20, id=207, version=50929,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=508, id=1, productName=Unmarked objects,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=95, productName=VS2003 (.NET) build 3077, version=3077,

count=1, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=48, id=207, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=151,

count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,

6dff8db988aea74564aa6776684c14653ce609681b95a32a60c258602663c82f

kernel32

comctl32

generic