9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d

Sharing

Copy URL Twitter E-mail

General

Target
9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d
Size 400KB
Sample260824-za3dhatbng
SHA256 9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d
MD5 64f1a0b998beccc966937034e6a10d04
SHA1 47d84acf538d09db35a444362c30d1e8d3f8f2a6
SHA512 20eab731d823392675d89b0d95d16a8cd049e8d92f3400c0937e2c3b4556d56fc184b73ee659331e98420f4226873733ab26e05a5d9ac3c6d56b59d8cdddc08d
SSDEEP 6144:oGfLcW9JY5uPMaLch+sUUDwK329A+RTd+jDt/tyOuJ9iT7m:ok9JnMaQhSu/G9mjBlq6nm
TLSH
T116947C12FD85A171C23306328F79A63156BDAD300A754B8F63FD3A696FB41C1A235B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d

File Explorer

9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d

.exe 400KB

9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d

IMPHASH a88fd643b5ec83d176e004f785c2ddaf
SHA256 9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d
MD5 64f1a0b998beccc966937034e6a10d04
SHA1 47d84acf538d09db35a444362c30d1e8d3f8f2a6
SHA512 20eab731d823392675d89b0d95d16a8cd049e8d92f3400c0937e2c3b4556d56fc184b73ee659331e98420f4226873733ab26e05a5d9ac3c6d56b59d8cdddc08d
SSDEEP 6144:oGfLcW9JY5uPMaLch+sUUDwK329A+RTd+jDt/tyOuJ9iT7m:ok9JnMaQhSu/G9mjBlq6nm
TLSH
T116947C12FD85A171C23306328F79A63156BDAD300A754B8F63FD3A696FB41C1A235B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

140488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle LoadLibraryW FindResourceW FindResourceExW CreateFileW GetProcAddress GlobalAlloc GlobalLock GlobalHandle GlobalUnlock GlobalFree CreateThread GetCurrentThreadId SetLastError SetEvent WaitForSingleObject Sleep SetFilePointer MulDiv lstrcmpW lstrcmpiW CreateMutexW CreateEventW CreateWaitableTimerW LoadLibraryExW GetModuleFileNameW GetModuleHandleW GetCommandLineW GetVersionExW MultiByteToWideChar WideCharToMultiByte ReadConsoleW WriteConsoleW SetStdHandle FindNextFileW FindFirstFileExW FindClose GetCommandLineA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind GetCPInfo GetLocaleInfoW LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead SetEndOfFile FlushFileBuffers ReadFile WriteFile SizeofResource LoadResource InitializeCriticalSectionAndSpinCount GetLastError RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy FreeLibrary LockResource DecodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer OutputDebugStringW IsDebuggerPresent InitializeCriticalSection

user32

DefWindowProcW CallWindowProcW RegisterClassExW GetClassInfoExW CreateWindowExW PostThreadMessageW IsChild DestroyWindow ShowWindow MoveWindow SetWindowPos PostMessageW SendMessageW RegisterWindowMessageW UnregisterClassW IsWindow GetWindowTextLengthW DialogBoxIndirectParamW EndDialog GetDlgItem SendDlgItemMessageW CharUpperW CharNextW SetFocus GetActiveWindow GetWindowInfo MapDialogRect LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongW GetFocus FillRect GetSysColor ScreenToClient ClientToScreen GetCursorPos SetWindowContextHelpId GetWindowRect GetClientRect GetWindowLongW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow UpdateWindow TrackPopupMenuEx GetSubMenu DestroyMenu LoadMenuW GetSystemMetrics DestroyAcceleratorTable CreateAcceleratorTableW KillTimer SetTimer ReleaseCapture SetCapture

gdi32

GetObjectW SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

SystemFunction036 RegSetValueExW RegQueryValueExW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExW RegOpenKeyA RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey

shell32

CommandLineToArgvW ord165 SHGetFolderPathW

ole32

CoGetClassObject CoUninitialize CoInitialize CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoCreateInstance CLSIDFromString CLSIDFromProgID StringFromGUID2 CoCreateGuid CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree OleInitialize OleUninitialize CreateStreamOnHGlobal OleLockRunning

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantInit OleCreateFontIndirect DispCallFunc UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear SysAllocString

shlwapi

PathRemoveFileSpecW PathRemoveFileSpecA PathAppendW PathAppendA PathStripPathW

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile InternetOpenW

Name

.text

Size

267KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.HIWGEEJ

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9473349914b2caede0bb2cf673d26f889de9e40b249f140ed4d2c2efff7f882d

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

generic