b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde

Sharing

Copy URL Twitter E-mail

General

Target
b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde
Size 185KB
Sample260821-ddgejsfl81
SHA256 b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde
MD5 7db70cf1e889451d8e750e2049522e11
SHA1 d6ca5f9c12f326be417100f1c648de871ee90df3
SHA512 6d460ebb09ac387f9e96116c1a0add631a52d1f1e6c29b72e6dc18eed4b1fdb4d5e816d675f12d6430bbf0c3f65295b62edeec9beca60c31c49990ed441e062a
SSDEEP 3072:R8NKsNfmH8rcfGi3cIacpLNbrrViKgPpmvKfn44ORSNZ/YUDB:CkeLQPfe44S4r
TLSH
T1A1043A0AFAB510BBD6BAC438C5531916FE7178914370ABDF57904AA74F2BBE09A3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde

File Explorer

b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde

.dll 185KB

b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde

IMPHASH 872c9a60e631b10c749e541ea0dc16b9
SHA256 b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde
MD5 7db70cf1e889451d8e750e2049522e11
SHA1 d6ca5f9c12f326be417100f1c648de871ee90df3
SHA512 6d460ebb09ac387f9e96116c1a0add631a52d1f1e6c29b72e6dc18eed4b1fdb4d5e816d675f12d6430bbf0c3f65295b62edeec9beca60c31c49990ed441e062a
SSDEEP 3072:R8NKsNfmH8rcfGi3cIacpLNbrrViKgPpmvKfn44ORSNZ/YUDB:CkeLQPfe44S4r
TLSH
T1A1043A0AFAB510BBD6BAC438C5531916FE7178914370ABDF57904AA74F2BBE09A3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileW GetFileAttributesW Sleep Wow64RevertWow64FsRedirection GetLastError GetFileAttributesExW DisableThreadLibraryCalls LockResource FindClose LoadResource FindResourceW GetProcAddress GetModuleHandleW CopyFileW GetTickCount WriteConsoleW GetModuleFileNameW GetModuleHandleExW Wow64DisableWow64FsRedirection GetCurrentProcess FindFirstFileW SizeofResource CloseHandle CreateDirectoryW SetFilePointerEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess HeapAlloc HeapFree FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize

user32

PeekMessageW

advapi32

AllocateAndInitializeSid RegSetValueExW FreeSid CheckTokenMembership RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantInit

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b2a407ee3e9bd0391b729fbe4b76de129e277fecadcd3598f2d0eb7d53470bde

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic