6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe

Sharing

Copy URL Twitter E-mail

General

Target
6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe
Size 332KB
Sample260824-la9wpavfph
SHA256 6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe
MD5 8b24f5594265126c2cbbb1bb7a8c6b7a
SHA1 9fe6eb8882d6f0c007c01feb4979df10e83f2d72
SHA512 7f7fefbbafb7690927bd60b20635b813b592cb7003e8ec3d5e3134e709275ff56f97bfa5574c11beeb8f99f9dbb15a3f766fa5fe690419230c6bde558262f796
SSDEEP 3072:UXBsS3lLyONgeYLccI64UlYuvCm6wwhMdwuNdpf7V0RUUj:0BsSRyQIcY3doMWIZ7Y
TLSH
T1DD749E33B5D0C4F2D16222321DE14B39AAFCFA311DA246239754EFBA7E359528B1F116
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe

File Explorer

6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe

.exe 332KB

6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe

IMPHASH 31d38f2fb2db3b56f0ac35f76dd714ac
SHA256 6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe
MD5 8b24f5594265126c2cbbb1bb7a8c6b7a
SHA1 9fe6eb8882d6f0c007c01feb4979df10e83f2d72
SHA512 7f7fefbbafb7690927bd60b20635b813b592cb7003e8ec3d5e3134e709275ff56f97bfa5574c11beeb8f99f9dbb15a3f766fa5fe690419230c6bde558262f796
SSDEEP 3072:UXBsS3lLyONgeYLccI64UlYuvCm6wwhMdwuNdpf7V0RUUj:0BsSRyQIcY3doMWIZ7Y
TLSH
T1DD749E33B5D0C4F2D16222321DE14B39AAFCFA311DA246239754EFBA7E359528B1F116
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LCMapStringA LoadLibraryA GetProcAddress FreeLibrary GetCommandLineA GetStartupInfoA CreateProcessA WaitForSingleObject WritePrivateProfileStringA CreateThread InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom GlobalAlloc GlobalLock LocalAlloc TlsAlloc GlobalFree GlobalUnlock GlobalHandle TlsFree GlobalReAlloc TlsSetValue LocalReAlloc TlsGetValue lstrcpynA GetEnvironmentVariableA GlobalFlags InterlockedDecrement lstrcatA lstrcpyA InterlockedIncrement SetLastError GetLastError GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetVersion GetProcessVersion SetErrorMode SetFilePointer FlushFileBuffers GetCPInfo GetOEMCP RtlUnwind RaiseException HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter LCMapStringW GetStringTypeA GetStringTypeW IsBadCodePtr SetStdHandle GetPrivateProfileStringA WriteFile GetLocalTime CreateFileA GetFileSize ReadFile GetModuleFileNameA GetCommandLineW LocalFree IsBadReadPtr HeapFree HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap Process32Next Process32First TerminateProcess QueryDosDeviceW OpenProcess GetCurrentProcess GetTempPathW Module32First CreateToolhelp32Snapshot GetTimeFormatA GetDateFormatA GetLocaleInfoA FindClose FindFirstFileW GetCurrentProcessId WideCharToMultiByte lstrlenW MultiByteToWideChar lstrcpyn CloseHandle SetWaitableTimer lstrlenA CreateWaitableTimerA

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA RegOpenKeyExA

comctl32

ord17

gdi32

SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox DeleteObject SetBkColor SelectObject RestoreDC SaveDC DeleteDC CreateBitmap Escape ExtTextOutA TextOutA RectVisible PtVisible GetObjectA GetStockObject GetDeviceCaps

oleaut32

VariantTimeToSystemTime

psapi

EnumProcesses GetProcessImageFileNameW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

shlwapi

PathFindFileNameA PathFindExtensionA

user32

GetDlgItem SetWindowLongA SetWindowPos ShowWindow SetFocus GetSystemMetrics GetWindowPlacement IsIconic SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow GetClientRect AdjustWindowRectEx DrawTextA GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush LoadStringA DestroyMenu GetMenuItemCount UnhookWindowsHookEx GetWindowTextA SetWindowTextA ClientToScreen GetWindow GetDlgCtrlID GetWindowRect PtInRect GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible GetCursorPos SetWindowsHookExA GetParent GetLastActivePopup IsWindowEnabled GetWindowLongA EnableWindow SetCursor SendMessageA PostMessageA PostQuitMessage CopyRect GrayStringA TabbedTextOutA ReleaseDC GetDC PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA SendMessageTimeoutA GetClassNameA GetWindowThreadProcessId EnumWindows PostMessageW GetWindowTextW GetWindowTextLengthW MsgWaitForMultipleObjects FindWindowExA UnregisterClassA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

Sharing

General

Malware Config

Signatures

File Explorer

6d6530b16786883480a31c14b70b9df33e539917d73b90e418bdc2d91a13cbbe

kernel32

advapi32

comctl32

gdi32

oleaut32

psapi

shell32

shlwapi

user32

winspool.drv

generic