5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df

Sharing

Copy URL Twitter E-mail

General

Target
5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df
Size 2.4MB
Sample260815-k56bbatwas
SHA256 5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df
MD5 34ac49f6738bcc8645385d54931c31a1
SHA1 fa533869975afe53e606cbf99825ecb825b4ecef
SHA512 0b09b7cca3acdccbe9c667465b3ba5c5044e87aff98ac34c82413e1f2d4144444544a7dc91e60773c4e0afdebbc3ad2ae6c56215fc963c5b4bb5d389926ca6ff
SSDEEP 49152:6l3i1J7slkO9BB3QI+F7QKKtoiKlZ5Q2FtdV+TorvEgBK7nOb5h4ZSIHN2:6Q7e5X+I27QJYrFXVxvEgBK7nV2
TLSH
T1C0C533129DFEA598F6E99C77A8B40B149D7BFC001F30466F6408625DB678A82393C377
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df

File Explorer

5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df

.dll 2.4MB

5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df

IMPHASH a7d12d8817abd7d18f0906fff0804219
SHA256 5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df
MD5 34ac49f6738bcc8645385d54931c31a1
SHA1 fa533869975afe53e606cbf99825ecb825b4ecef
SHA512 0b09b7cca3acdccbe9c667465b3ba5c5044e87aff98ac34c82413e1f2d4144444544a7dc91e60773c4e0afdebbc3ad2ae6c56215fc963c5b4bb5d389926ca6ff
SSDEEP 49152:6l3i1J7slkO9BB3QI+F7QKKtoiKlZ5Q2FtdV+TorvEgBK7nOb5h4ZSIHN2:6Q7e5X+I27QJYrFXVxvEgBK7nV2
TLSH
T1C0C533129DFEA598F6E99C77A8B40B149D7BFC001F30466F6408625DB678A82393C377
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6668288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\RDBuildPool\20260401-22776\build_vs2012\V94_Formal\claud.pdb

Name

Size

959KB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

oovzqxej

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

qnguflsi

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.taggant

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=4, id=203, version=50929,

count=8, id=205, version=50929,

count=8, id=206, version=50929,

count=3, id=207, version=50929,

count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=271, id=1, productName=Unmarked objects,

count=62, id=207, productName=VS2012 UPD4 build 61030, version=61030,

count=2, id=11, version=8966,

count=7, id=10, version=8966,

count=1, id=205, productName=VS2012 UPD4 build 61030, version=61030,

count=138, id=207, version=61219,

count=11, id=206, version=61219,

count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,

count=1, id=151,

count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,

Sharing

General

Malware Config

Signatures

File Explorer

5221056b9c845c3d2264a3599d4b07780a52cfa72c8666a05df2763ca708e7df

kernel32

generic