b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167

Sharing

Copy URL Twitter E-mail

General

Target
b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167
Size 1.3MB
Sample260820-p4pdmaxejb
SHA256 b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167
MD5 4a5ca7785684e0b34a5fe818a67b9f29
SHA1 eb780c7784b14bd8a6de8967df4084588024b792
SHA512 b64a0c1511dc44e0ad71f6141a52df2270013c2b20e5d66478547884dd2fc4ce39f9eb9a74dace00caf31633484477adc945bed680e9f4328495f5517f51f8d7
SSDEEP 24576:fwjOy9anaidJ1kOc5TM3a5c4XMbWUicPuT:YjOy9anaidJ1kOiTea5cuMbJTuT
TLSH
T17D552C11FE0C1946E64F64F430A6B02720A4B18699C8FA5679D46F68F3178F13F986EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167

File Explorer

b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167

.exe 1.3MB

b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167

IMPHASH dc2961c72a9d2c9fd8fb22e888e79276
SHA256 b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167
MD5 4a5ca7785684e0b34a5fe818a67b9f29
SHA1 eb780c7784b14bd8a6de8967df4084588024b792
SHA512 b64a0c1511dc44e0ad71f6141a52df2270013c2b20e5d66478547884dd2fc4ce39f9eb9a74dace00caf31633484477adc945bed680e9f4328495f5517f51f8d7
SSDEEP 24576:fwjOy9anaidJ1kOc5TM3a5c4XMbWUicPuT:YjOy9anaidJ1kOiTea5cuMbJTuT
TLSH
T17D552C11FE0C1946E64F64F430A6B02720A4B18699C8FA5679D46F68F3178F13F986EF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

kernel32

CloseHandle CreateMutexA CreateProcessA CreateRemoteThread DeleteCriticalSection DeleteFileA EnterCriticalSection GetConsoleWindow GetCurrentProcess GetLastError GetModuleHandleA GetProcAddress GetSystemDirectoryA InitializeCriticalSection LeaveCriticalSection ResumeThread SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAllocEx VirtualProtect VirtualQuery WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

mbrtowc wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush fputc setvbuf

api-ms-win-crt-string-l1-1-0

strlen strncmp strnlen wcslen wcsnlen

user32

ShowWindow

Name

.text

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

163B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

512B

Virtual Size

278B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/126

Size

512B

Virtual Size

51B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b00e42d34f1489a0e18c933c6ae8ec6210b5dd53ddd1ecd25bae57658ef33167

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic