ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897

Sharing

Copy URL Twitter E-mail

General

Target
ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897
Size 156KB
Sample260822-nnfacateka
SHA256 ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897
MD5 326e70da15f021069a20aa8a39bd5159
SHA1 d8191d618e838df51a6ad057703426739b088cff
SHA512 f872395ecef7f59b5d291f051afda8a2c058f430f33196018f88adf83c2fbdd235135361a1f85c9ec659d21d3c94a96a6c26fb7c3b4ffbfd50acf7ec36947aec
SSDEEP 1536:3DEpyblxECmXZvvE88ugoK4B+Rwd/NHhxHx5vcMBCn:3DEpyblxpoKMa8/NHhxHx50MBC
TLSH
T10FF3A6121BED98F4E17A8FF515FB9FA20D3938030EF5865D0B64EA4C2D75980AEA0357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897

File Explorer

ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897

.dll 156KB

ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897

IMPHASH 2c725e25b6be7e38869cb43f9492a56a
SHA256 ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897
MD5 326e70da15f021069a20aa8a39bd5159
SHA1 d8191d618e838df51a6ad057703426739b088cff
SHA512 f872395ecef7f59b5d291f051afda8a2c058f430f33196018f88adf83c2fbdd235135361a1f85c9ec659d21d3c94a96a6c26fb7c3b4ffbfd50acf7ec36947aec
SSDEEP 1536:3DEpyblxECmXZvvE88ugoK4B+Rwd/NHhxHx5vcMBCn:3DEpyblxpoKMa8/NHhxHx50MBC
TLSH
T10FF3A6121BED98F4E17A8FF515FB9FA20D3938030EF5865D0B64EA4C2D75980AEA0357
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CredEnumerateW CredFree CredWriteW

comctl32

InitCommonControls ord410 ord412 ord413

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar RaiseException SizeofResource lstrcmpW

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp free fwrite getenv memcpy memmove memset strchr strcmp strcpy strcspn strlen wcschr wcslen wcsrchr

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ef4a11ad715056f4a393289d3e6fd8b7c165d1a1e11dc2ae4d3f33763e192897

advapi32

comctl32

kernel32

ntdll

ucrtbase

user32

generic