66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901

Sharing

Copy URL Twitter E-mail

General

Target
66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901
Size 1.4MB
Sample260818-pee4nas1cs
SHA256 66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901
MD5 c7d820f60019dcb2c2df0b1a20b19db5
SHA1 631dcbab20aa7ee25178a8f3c27d5cf83aeded44
SHA512 3969dc736c942f7e83658c74af846ffd8fd38c833e63e1e9fe3d686c6d2fa249ca3e95a78cb1f6ab7e987928ba4d2edc9693024efa7dc8ccdfe278f4bcc2deaa
SSDEEP 12288:DeveOeRWveOeRsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DWeVeeVzNyBo4kx929bL3Hnx
TLSH
T19E652311335801FAF05A2670C4A7C610DE33FC876B79D3DEAA1528B69F766D09E26327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901

File Explorer

66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901

.exe 1.4MB

66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901

IMPHASH 6212d017aab998f574afaab6cee207f2
SHA256 66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901
MD5 c7d820f60019dcb2c2df0b1a20b19db5
SHA1 631dcbab20aa7ee25178a8f3c27d5cf83aeded44
SHA512 3969dc736c942f7e83658c74af846ffd8fd38c833e63e1e9fe3d686c6d2fa249ca3e95a78cb1f6ab7e987928ba4d2edc9693024efa7dc8ccdfe278f4bcc2deaa
SSDEEP 12288:DeveOeRWveOeRsLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DWeVeeVzNyBo4kx929bL3Hnx
TLSH
T19E652311335801FAF05A2670C4A7C610DE33FC876B79D3DEAA1528B69F766D09E26327
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\1711012\Desktop\UEIP_V5\UBTService.root\UBTService\Bin\Release\TriggerFramework.pdb

kernel32

LCMapStringEx HeapSize WriteConsoleW SetStdHandle GetStringTypeW HeapReAlloc CloseHandle GetFileAttributesW Sleep GetLastError FlushFileBuffers LoadLibraryW OutputDebugStringW GetCommandLineW HeapFree IsDebuggerPresent IsProcessorFeaturePresent EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection RtlUnwindEx SetLastError GetCurrentThreadId ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetStdHandle WriteFile GetModuleFileNameW GetProcessHeap GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection InitOnceExecuteOnce GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 GetEnvironmentStringsW FreeEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter FlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentProcess TerminateProcess GetModuleHandleW HeapAlloc IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryExW CreateFileW

user32

EndDialog PostQuitMessage EndPaint BeginPaint DestroyWindow DialogBoxParamW CreateWindowExW RegisterClassExW LoadCursorW LoadIconW LoadAcceleratorsW LoadStringW DefWindowProcW

advapi32

EventWrite EventRegister EventUnregister

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

Name

.text

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

66053521fa34d0853f73ddd9c6432aad2616fe9f0de51afd94f7cd6a78c76901

kernel32

user32

advapi32

shell32

shlwapi

generic