0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8

Sharing

Copy URL Twitter E-mail

General

Target
0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8
Size 979KB
Sample260820-datkps1we1
SHA256 0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8
MD5 ab7a4163bebcfed7c56d0f16a42602e8
SHA1 446cdf1e5ada75531f76980e2002872037822d60
SHA512 d42c1697b1c532e97dbee1e07c21e43dad747571f78c9ca6701b318c524a9d562aa3704545f74840b2e5bc4521ccd4414e590dd508046edb399ec2e355d1ae55
SSDEEP 12288:Sq+EqLXIwFed5BmbnW2WivZXHe+DHJC141NTX4Hu8rSfDc7:SpEqmrNevZXe+DprNTX4HBrSfDc7
TLSH
T1DE25D30266F90554F1F77A745AB59AA48A3BBC916E39CA4E039C405E1FB3E80CD31B73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8

File Explorer

0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8

.exe 979KB

0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8

IMPHASH ecb6494f937f907af4124a955770dae6
SHA256 0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8
MD5 ab7a4163bebcfed7c56d0f16a42602e8
SHA1 446cdf1e5ada75531f76980e2002872037822d60
SHA512 d42c1697b1c532e97dbee1e07c21e43dad747571f78c9ca6701b318c524a9d562aa3704545f74840b2e5bc4521ccd4414e590dd508046edb399ec2e355d1ae55
SSDEEP 12288:Sq+EqLXIwFed5BmbnW2WivZXHe+DHJC141NTX4Hu8rSfDc7:SpEqmrNevZXe+DprNTX4HBrSfDc7
TLSH
T1DE25D30266F90554F1F77A745AB59AA48A3BBC916E39CA4E039C405E1FB3E80CD31B73
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

crypt32

CertGetNameStringA

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust

gdiplus

GdipCreateFont GdipDeleteFontFamily GdipCreateStringFormat GdipFillPath GdipFillPolygon GdipFillRectangleI GdipFillRectangle GdipDrawPath GdipDrawRectangle GdipDrawLine GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipDeleteStringFormat GdipSetPenEndCap GdipSetPenStartCap GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusStartup GdipFree GdipAlloc GdipDrawString GdipSetStringFormatAlign GdipCreateFromHDC GdipSetStringFormatLineAlign GdipCreateFontFamilyFromName

user32

SetProcessDPIAware LoadIconA LoadCursorA SetCursor MessageBoxW ValidateRect ReleaseDC GetDC GetSystemMetrics ReleaseCapture UpdateLayeredWindow ShowWindow CreateWindowExW RegisterClassExA PostQuitMessage DefWindowProcA SendMessageA DispatchMessageA TranslateMessage GetMessageA TrackMouseEvent

gdi32

SelectObject GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap

kernel32

HeapSize SetFilePointerEx GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle HeapReAlloc GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateFileW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentVariableA CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile SetFilePointer WriteFile GetTempPathA CloseHandle SetHandleInformation GetLastError CreatePipe DeviceIoControl WaitForSingleObject CreateMutexA GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessA GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource GetFirmwareEnvironmentVariableA FindResourceA CopyFileA MultiByteToWideChar GetUserDefaultUILanguage RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW EnterCriticalSection RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer

Name

.text

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.intg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

767KB

Virtual Size

766KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0902ccb2e3c2c6be6b3f80ebfcb748c837b80f349a0198ba08b9049d52395eb8

advapi32

crypt32

wintrust

gdiplus

user32

gdi32

kernel32

generic