52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d

General

Target
52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d
Size 15.3MB
Sample260824-ttf2qaeb67
SHA256 52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d
MD5 b769b122d1f73b9d7f4bbf1bfc8252ec
SHA1 480e22114dda90d2956b8d416891df8c244e8f7b
SHA512 47440dc3799c6501c67c0ec00a2407e15762c07d02029a90f0c2333762c2b1aab9376905d3b2a2b957a3a6cd1e6c9e88fc447b019b9b8adc9ee4437b9b184539
SSDEEP 393216:zp+cXzLtoqUAlvAQ2Fse68HgLVkaIKS6MWb2l6WTrQs2Ouc0wk:zzXnqDAlf2aeZgLVvHml6WwROd0wk
TLSH
T1D4F63374E5A740DEDB635378EE870AA3F3B33B052B6245DB057254446E279E1883BB83
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d

File Explorer

52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d

.exe 15.3MB

52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d

IMPHASH 0694d61a7883b2624e56e44023c423b9
SHA256 52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d
MD5 b769b122d1f73b9d7f4bbf1bfc8252ec
SHA1 480e22114dda90d2956b8d416891df8c244e8f7b
SHA512 47440dc3799c6501c67c0ec00a2407e15762c07d02029a90f0c2333762c2b1aab9376905d3b2a2b957a3a6cd1e6c9e88fc447b019b9b8adc9ee4437b9b184539
SSDEEP 393216:zp+cXzLtoqUAlvAQ2Fse68HgLVkaIKS6MWb2l6WTrQs2Ouc0wk:zzXnqDAlf2aeZgLVvHml6WwROd0wk
TLSH
T1D4F63374E5A740DEDB635378EE870AA3F3B33B052B6245DB057254446E279E1883BB83
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

56136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW CommandLineToArgvW

kernel32

DeleteCriticalSection WriteConsoleW GetStdHandle GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW CreateDirectoryW CreateFileW GetFileSize GetFullPathNameW GetShortPathNameW WriteFile GetTempPathW CloseHandle GetLastError QueryPerformanceCounter WaitForSingleObject GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetSystemTimeAsFileTime CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW GetProcAddress FormatMessageA SetDllDirectoryW WideCharToMultiByte SetConsoleCtrlHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapReAlloc RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA GetStringTypeW HeapAlloc HeapFree MultiByteToWideChar FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.0MB

Virtual Size

15.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

52a53a86d525226f54ad51a37a5c11e8edf6d5a520eecfa0787c3af1bd61f51d

shell32

kernel32

generic