c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558

Sharing

Copy URL Twitter E-mail

General

Target
c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558
Size 1.6MB
Sample260820-ec4n5ayhmf
SHA256 c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558
MD5 6e27435d9213274902e5db8d8146f03a
SHA1 583de78c994b86f836587dfcf9007b15fdb8dc52
SHA512 495a964882eff738490bdb13eaf2ca74ca318884f4c05ed92434da1d547c5dee97fe336c43f255f26d9f869e77bc59a17d2e79eb8f936ccf17c65e22c94ce6e2
SSDEEP 49152:YfJuFjqM+Ut7/hHbEpWgvbtEq6tdeFRsU:ou2MJt7/hHbEpzweP1
TLSH
T13785AE16A7D401FDE0BBD1B9CA5A8912E772780A07719BDF07D056662F27BE04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558

File Explorer

c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558

.exe 1.6MB

c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558

IMPHASH b842c9d7c0fe31ad0e412f80fea55182
SHA256 c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558
MD5 6e27435d9213274902e5db8d8146f03a
SHA1 583de78c994b86f836587dfcf9007b15fdb8dc52
SHA512 495a964882eff738490bdb13eaf2ca74ca318884f4c05ed92434da1d547c5dee97fe336c43f255f26d9f869e77bc59a17d2e79eb8f936ccf17c65e22c94ce6e2
SSDEEP 49152:YfJuFjqM+Ut7/hHbEpWgvbtEq6tdeFRsU:ou2MJt7/hHbEpzweP1
TLSH
T13785AE16A7D401FDE0BBD1B9CA5A8912E772780A07719BDF07D056662F27BE04E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

647028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte MultiByteToWideChar UnmapViewOfFile CreateFileMappingW MapViewOfFile Sleep GetCurrentProcessId LoadLibraryW GetProcAddress GetModuleHandleA LoadLibraryA InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW DecodePointer GetModuleFileNameW HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetTempPathW WaitNamedPipeW ReadFile WritePrivateProfileStringW GetCurrentProcess FindResourceW LoadResource SizeofResource LockResource LoadLibraryExW GetFileAttributesW FreeLibrary GetProcessTimes GetSystemTimeAsFileTime IsWow64Process SetLastError ResumeThread WaitForSingleObject GetFileSizeEx LocalFree CreateDirectoryW SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW WriteFile CreateFileW GetLastError GetPrivateProfileStringW CloseHandle GetCommandLineA GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW FormatMessageA GetLocaleInfoEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetFileType SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode RtlUnwind

user32

MessageBoxA SetProcessDPIAware MessageBoxW

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate

mscoree

CorBindToRuntime CLRCreateInstance

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

PlaySoundW

Name

.text

Size

824KB

Virtual Size

823KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

272KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

542KB

Virtual Size

542KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c38af9302157a16a75d6e37d5f0199d4a67810546d3e1389ecfc7ddf24a04558

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

version

winmm

generic