fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b

Sharing

Copy URL Twitter E-mail

General

Target
fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b
Size 1.3MB
Sample260815-q7da7sysbs
SHA256 fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b
MD5 110aba19efb64cca21521187ec4398e0
SHA1 9425922472d2e3dafd28e4731c6274523b665a60
SHA512 3d925049e9befb1b8233d5dcf4d47e4e5807ee6ac4a3189d4f5ce47ddfa788a5af9e84f076e0f2cb92cba05c21e1f81065c7b978dfded38cd37677710231534b
SSDEEP 24576:l3ydXKKWMOzwoz+geKgOcR7OK/6v4e2UjVpuQxW3U34:liAKWMLoz+H/T96v4e2UjVi
TLSH
T188551A0299CB0DB0CCD22BF4618F737BA734FE708825CFABE14899259F635C5656A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b

File Explorer

fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b

.exe 1.3MB

fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b

IMPHASH 8312cd1749bbdb79df3aa27501b721f0
SHA256 fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b
MD5 110aba19efb64cca21521187ec4398e0
SHA1 9425922472d2e3dafd28e4731c6274523b665a60
SHA512 3d925049e9befb1b8233d5dcf4d47e4e5807ee6ac4a3189d4f5ce47ddfa788a5af9e84f076e0f2cb92cba05c21e1f81065c7b978dfded38cd37677710231534b
SSDEEP 24576:l3ydXKKWMOzwoz+geKgOcR7OK/6v4e2UjVpuQxW3U34:liAKWMLoz+H/T96v4e2UjVi
TLSH
T188551A0299CB0DB0CCD22BF4618F737BA734FE708825CFABE14899259F635C5656A712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

gdi32

CreateFontW CreateSolidBrush DeleteObject EnumFontFamiliesExW GetStockObject SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateSemaphoreA DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesW GetHandleInformation GetLastError GetLocalTime GetModuleHandleA GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetProcessAffinityMask GetStartupInfoW GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WritePrivateProfileStringW

msvcrt

__mb_cur_max __p__commode __p__fmode __p__wcmdln __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _beginthreadex _cexit _endthreadex _errno _initterm _iob _onexit _setjmp3 _vsnprintf _vsnwprintf _wcsicmp abort atoi calloc exit fgetwc fprintf fputc fputs free fwrite getc getenv iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc setlocale signal strchr strcmp strcoll strerror strftime strlen strncmp strtoul strxfrm towlower towupper vfprintf wcscmp wcscoll wcsftime wcslen wcsncpy_s wcsxfrm _strdup _read

shell32

ShellExecuteExW Shell_NotifyIconW

shlwapi

PathFileExistsW

user32

AdjustWindowRect AppendMenuW BeginPaint CallWindowProcW ClientToScreen CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawTextW EnableWindow EndPaint FillRect GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetMessageW GetSystemMetrics GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect LoadCursorW LoadIconW LoadStringW MapWindowPoints MessageBoxW PostMessageW PostQuitMessage PtInRect RegisterClassExW ReleaseDC SendMessageW SetCursor SetForegroundWindow SetWindowLongW SetWindowTextW ShowWindow TrackMouseEvent TrackPopupMenu TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

566KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

157B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

1024B

Virtual Size

866B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

512B

Virtual Size

494B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fed67cd73a72c6cc1a7c281b333c663c9917858bf6a04af8d77aa63fd0f7252b

comctl32

gdi32

kernel32

msvcrt

shell32

shlwapi

user32

generic