c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc

General

Target
c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc
Size 13.6MB
Sample260816-e2j11szckb
SHA256 c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc
MD5 1b1f42a165f84e91ab73561fa3943b1c
SHA1 6fff28fc3affae2717aa11b937c7a21558a2334f
SHA512 d1d89bad923dfba6578a702a986c2d340538dffa3ad88cba94ad007772fa1fc4b6a740891fdcdd5e69e9928800ea715d626b9bdb32cbb44d8f0df476c7c0932e
SSDEEP 196608:/i3QDCpQaJGMi3QDCpQaJGb/5+bx4QQuyT/kCvDOq2421qeSMgoVhCDPCFvlzLb:/y+CufMy+CufAUT/kClqQeSMFVwDGvpn
TLSH
T13BE6BE30765AC42BC97B05B11A6C8B9F91287F750B7254C7B3CC2E6E5AB49C24732E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc

File Explorer

c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc

.exe 13.6MB

c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc

IMPHASH 7c194251e86188363a60c4bd78b0d506
SHA256 c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc
MD5 1b1f42a165f84e91ab73561fa3943b1c
SHA1 6fff28fc3affae2717aa11b937c7a21558a2334f
SHA512 d1d89bad923dfba6578a702a986c2d340538dffa3ad88cba94ad007772fa1fc4b6a740891fdcdd5e69e9928800ea715d626b9bdb32cbb44d8f0df476c7c0932e
SSDEEP 196608:/i3QDCpQaJGMi3QDCpQaJGb/5+bx4QQuyT/kCvDOq2421qeSMgoVhCDPCFvlzLb:/y+CufMy+CufAUT/kClqQeSMFVwDGvpn
TLSH
T13BE6BE30765AC42BC97B05B11A6C8B9F91287F750B7254C7B3CC2E6E5AB49C24732E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1678916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\ReleaseJob\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW SetEvent CreateEventExW WaitForSingleObject RemoveDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW MoveFileW GetLastError EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread GetProcAddress LoadLibraryExW GetCurrentProcess Sleep WideCharToMultiByte GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW CreateProcessW GetExitCodeProcess GetWindowsDirectoryW CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetEnvironmentStringsW LocalFree InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID GetLocalTime ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW CreateNamedPipeW ConnectNamedPipe TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

c179d10d9cf1f1e335a22edd0693602f0df297a9f327c4c7dd231879e1c488bc

kernel32

generic