6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c

Sharing

Copy URL Twitter E-mail

General

Target
6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c
Size 337KB
Sample260818-dn7pgswsgx
SHA256 6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c
MD5 e2f405c478d547a4fe7daeee756d17c8
SHA1 02cba26fc953cce3831cd2fcf009e67132415011
SHA512 872dc315cf1806d9af0e54043cee5ab4e83a190f3d25d11d609fb272a817d79085ba6d9a5cf180c714e045e8fa9bb807e6afdc4f449ad78ee346791a73b65f2e
SSDEEP 6144:uY6PD39XDAZnMOTBUvQzCgmpRlNJMCbcF4NNyB1kCIr6Y+3eI:uY6PL9k2OqvQz98HMCbcFANA1kz+35
TLSH
T17F74F10B77A471F4E1768679C952690AD37178321721AF9F0764428A1F23FE1AE3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c

File Explorer

6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c

.exe 337KB

6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c

IMPHASH 4528c42a0d9c4d6221ff0bec0d491339
SHA256 6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c
MD5 e2f405c478d547a4fe7daeee756d17c8
SHA1 02cba26fc953cce3831cd2fcf009e67132415011
SHA512 872dc315cf1806d9af0e54043cee5ab4e83a190f3d25d11d609fb272a817d79085ba6d9a5cf180c714e045e8fa9bb807e6afdc4f449ad78ee346791a73b65f2e
SSDEEP 6144:uY6PD39XDAZnMOTBUvQzCgmpRlNJMCbcF4NNyB1kCIr6Y+3eI:uY6PL9k2OqvQz98HMCbcFANA1kz+35
TLSH
T17F74F10B77A471F4E1768679C952690AD37178321721AF9F0764428A1F23FE1AE3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

221184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualProtect OutputDebugStringA VirtualAlloc ExpandEnvironmentStringsA UnmapViewOfFile GetModuleHandleA GetLastError CreateFileA LoadLibraryA GlobalAlloc CloseHandle GetProcAddress CreateFileMappingA CreateProcessA MapViewOfFile VirtualQuery WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle GetFileType GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP HeapFree HeapAlloc LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW CreateFileW

user32

DefWindowProcW SetPropA DestroyWindow ShowWindow SetMenuItemInfoA SetWindowTextA DestroyMenu LoadIconW LoadCursorW EnableScrollBar PostQuitMessage CreateMenu InsertMenuItemA RegisterClassExA UpdateWindow CreateWindowExA

shlwapi

StrStrA

Name

.text

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.8Zu

Size

3KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.stub

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6edd64252d310e6c592bbfcbe1538f501718c08d189dffe3bba934ce996b231c

kernel32

user32

shlwapi

generic