10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559

Sharing

Copy URL Twitter E-mail

General

Target
10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559
Size 175KB
Sample260817-mpm6xayamd
SHA256 10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559
MD5 67cc0f0554fa61b6d468e06c50c773ff
SHA1 fda9b0f9ff0697d1e5017c2ab160e3e9b34930db
SHA512 e4dc058e9359ac224a53a8fb88b881853d75ac0df99ec225f305c72cb5497c282fefc32506083f1b16c4ecdde959671c9ea54d70ec669758c6ddf913e5a7630e
SSDEEP 3072:wEmA+cSyEfys0vnGA/HHNGqLHf/4fuoRIiKX0AavCVhGt9U4Y3g:wA5EfyzvGA/NJX4f95jchI9UXg
TLSH
T1AA047D0AB3A500B5E8778279CD635606F7B278120720DB9F07644776AF2F7A16D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559

File Explorer

10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559

.dll 175KB

10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559

IMPHASH 02968bdcd4d63b597ed7b9cdbc483467
SHA256 10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559
MD5 67cc0f0554fa61b6d468e06c50c773ff
SHA1 fda9b0f9ff0697d1e5017c2ab160e3e9b34930db
SHA512 e4dc058e9359ac224a53a8fb88b881853d75ac0df99ec225f305c72cb5497c282fefc32506083f1b16c4ecdde959671c9ea54d70ec669758c6ddf913e5a7630e
SSDEEP 3072:wEmA+cSyEfys0vnGA/HHNGqLHf/4fuoRIiKX0AavCVhGt9U4Y3g:wA5EfyzvGA/NJX4f95jchI9UXg
TLSH
T1AA047D0AB3A500B5E8778279CD635606F7B278120720DB9F07644776AF2F7A16D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetExitCodeProcess GetModuleHandleA LoadLibraryA ReadFile GetFileSizeEx WriteFile SetFileTime CreateFileA CloseHandle GetVolumeInformationW FindFirstFileW MoveFileA FindNextFileW GetDriveTypeA GetVolumeInformationA ExitThread lstrcpyA GetDiskFreeSpaceExA FindClose CreateRemoteThread LoadLibraryW GetWindowsDirectoryA WTSGetActiveConsoleSessionId SystemTimeToFileTime WideCharToMultiByte GetSystemTime lstrcmpW SetEndOfFile HeapReAlloc HeapSize WriteConsoleW FlushFileBuffers SetStdHandle GetStringTypeW VirtualAllocEx GetModuleHandleW GetProcAddress Process32FirstW Process32NextW GetLastError Sleep CreateToolhelp32Snapshot OpenProcess CreateFileW WaitForSingleObject lstrlenA lstrlenW WriteProcessMemory GetModuleFileNameA ProcessIdToSessionId GetLocalTime GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar HeapFree HeapAlloc GetACP GetStdHandle GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP LCMapStringW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP

user32

GetCursorInfo wsprintfW GetForegroundWindow SetProcessDPIAware SetForegroundWindow WaitForInputIdle DrawIcon GetWindowTextA

gdi32

CreateDIBSection

advapi32

AdjustTokenPrivileges CryptAcquireContextA CreateProcessAsUserA SetTokenInformation CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken CryptGetHashParam DuplicateTokenEx CryptReleaseContext RegCreateKeyA RegSetValueExA LookupPrivilegeValueW

shell32

SHGetKnownFolderPath

ole32

CreateStreamOnHGlobal

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

Sharing

General

Malware Config

Signatures

File Explorer

10b00a5c8a53171d1b5b2335983e0a5333e6296179cd107af8ee559fa2bd9559

kernel32

user32

gdi32

advapi32

shell32

ole32

wtsapi32

generic