10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f

Sharing

Copy URL Twitter E-mail

General

Target
10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f
Size 2.4MB
Sample260824-dn241aseja
SHA256 10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f
MD5 809ec1187e9e2937057b72b99c33bb96
SHA1 ea81503b9ad4945d3c7e5e397120a604a2906754
SHA512 1aa42f5c25727d1a4571024039b3984415826f13cf03f7d7b42d34de69373e608b538fbb268fba8414d9e17af74e1dc753982f7db2907bd310edb6c4360ac9ab
SSDEEP 24576:KdvN5huXueFHmlMdduZODy6+egNFRfy6CxoXov4ZdxTtPA1H1UWP+Ec0xMkN8JsA:cvSueFaYu6+eoFRfpQ1HaWWfdTtgHn2v
TLSH
T191C5D84369DB0DA5DED277B461D36335A778FD71CB291F2BAA08C23169532C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f

File Explorer

10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f

.exe 2.4MB

10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f

IMPHASH 3f5b7bd32796c5bd69c3357b850cfb94
SHA256 10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f
MD5 809ec1187e9e2937057b72b99c33bb96
SHA1 ea81503b9ad4945d3c7e5e397120a604a2906754
SHA512 1aa42f5c25727d1a4571024039b3984415826f13cf03f7d7b42d34de69373e608b538fbb268fba8414d9e17af74e1dc753982f7db2907bd310edb6c4360ac9ab
SSDEEP 24576:KdvN5huXueFHmlMdduZODy6+egNFRfy6CxoXov4ZdxTtPA1H1UWP+Ec0xMkN8JsA:cvSueFaYu6+eoFRfpQ1HaWWfdTtgHn2v
TLSH
T191C5D84369DB0DA5DED277B461D36335A778FD71CB291F2BAA08C23169532C4AD2EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comdlg32

GetOpenFileNameA

gdi32

CreateFontA DeleteObject

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesA GetFullPathNameA GetHandleInformation GetLastError GetLocalTime GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _errno _fdopen _fileno _fmode _fstat64 _initterm _lseeki64 _onexit _read _setjmp _strdup _strnicmp _ultoa _vsnprintf _write abort atoi calloc exit fclose fflush fopen fprintf fputc fputs free fwrite getc islower isspace isupper iswctype isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc setlocale setvbuf signal sprintf strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm tolower towlower towupper ungetc vfprintf wcscoll wcsftime wcslen wcsxfrm

psapi

GetProcessMemoryInfo

user32

CreateWindowExA DefWindowProcA DispatchMessageA EnableWindow GetDlgItem GetMessageA GetWindow GetWindowTextA GetWindowTextLengthA KillTimer LoadCursorA MessageBoxA PostQuitMessage RegisterClassA SendMessageA SetTimer SetWindowTextA ShowWindow TranslateMessage UpdateWindow

ws2_32

WSACleanup WSAStartup accept bind closesocket gethostbyname gethostname htons inet_ntoa listen ntohs recv select send setsockopt socket

Name

.text

Size

717KB

Virtual Size

716KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

465B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

512B

Virtual Size

496B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10760ac7f467b9511616439bf4fb09d4760be0e61849bcfa1c6bc0c1a281450f

comdlg32

gdi32

kernel32

msvcrt

psapi

user32

ws2_32

generic