4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f

Sharing

Copy URL Twitter E-mail

General

Target
4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f
Size 242KB
Sample260825-2c2k4azcle
SHA256 4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f
MD5 5a86fd39549683d8508135b06b08f304
SHA1 21278571bd58bab060f5aeda5f5a949b35d94eb0
SHA512 2461b5e2a0906bccb5a710f81663817f614caa5a87629d38b39ec2c4cd2de824ce6cb47e69dd5bcb007be0220ce549096d8e383b22ae1da07efa4cf0661658d5
SSDEEP 6144:yDkLLPRvuHXysFuDBwL6Y5O0QzI+icA4XQBX8EOyYNDCPSFucYbHe:yDrhBsEOyYp
TLSH
T17434A705DBFA12D4E8B7C23489725322B9B17C24C73597DB9B40562A8F30BD0DE39B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f

File Explorer

4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f

.exe 242KB

4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f

IMPHASH ccf1d87438086313f2f04ccea1b9f7c4
SHA256 4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f
MD5 5a86fd39549683d8508135b06b08f304
SHA1 21278571bd58bab060f5aeda5f5a949b35d94eb0
SHA512 2461b5e2a0906bccb5a710f81663817f614caa5a87629d38b39ec2c4cd2de824ce6cb47e69dd5bcb007be0220ce549096d8e383b22ae1da07efa4cf0661658d5
SSDEEP 6144:yDkLLPRvuHXysFuDBwL6Y5O0QzI+icA4XQBX8EOyYNDCPSFucYbHe:yDrhBsEOyYp
TLSH
T17434A705DBFA12D4E8B7C23489725322B9B17C24C73597DB9B40562A8F30BD0DE39B99
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

137648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

R:\buildbot\output-VS-amd64\msvc_pdb\winhlp32.pdb

user32

PostQuitMessage PostMessageW MoveWindow MessageBoxA LoadIconW LoadCursorW CreateIconFromResourceEx InvalidateRect GetWindowRect GetWindow GetWindowLongPtrW LoadStringA GetWindowLongW GetSystemMetrics GetSubMenu GetParent GetMessagePos GetMessageW GetDlgItem GetClientRect EndPaint DispatchMessageW DestroyWindow DestroyMenu DefWindowProcA ClientToScreen CallWindowProcA MessageBoxW GetWindowLongPtrA LoadMenuW RedrawWindow RegisterClassExA ScreenToClient SendDlgItemMessageW SendMessageA SendMessageW SetActiveWindow SetCursor SetWindowLongPtrA SetWindowLongPtrW SetWindowTextA SystemParametersInfoW TrackPopupMenu TranslateAcceleratorW TranslateMessage wsprintfA LoadAcceleratorsW BeginPaint AdjustWindowRect ShowWindow SetWindowPos SetFocus LoadStringW LoadImageW GetMenu EnableWindow CreateWindowExA CheckMenuItem ReleaseDC GetDC DestroyIcon

gdi32

DeleteEnhMetaFile DeleteObject GetEnhMetaFileBits SelectObject DeleteDC SetTextColor CreateFontIndirectW GetTextExtentPointA GetTextMetricsW TextOutA CreateEnhMetaFileW CreateDIBitmap CreateCompatibleDC CreateBitmap CloseEnhMetaFile SetBkColor BitBlt

shell32

ShellExecuteA ShellAboutW

comctl32

PropertySheetA InitCommonControls CreatePropertySheetPageA

comdlg32

GetOpenFileNameA PrintDlgW

msvcrt

signal _acmdln __initenv _initterm _fpreset _cexit __set_app_type __getmainargs _amsg_exit __setusermatherr _iob bsearch strcspn memcmp __lconv_init realloc malloc strtol sprintf memcpy memset strcpy strcmp strlen strchr _stricmp _assert _snprintf strcat memmove strrchr fprintf fwrite _errno exit

kernel32

GetProcAddress GetFileAttributesA OpenFile MulDiv lstrcpynA HeapReAlloc lstrcmpiA HeapAlloc GetProcessHeap _lclose _hread CreateFileA CloseHandle GetCurrentDirectoryA SearchPathA TlsGetValue GetEnvironmentVariableA GetLastError LocalAlloc LocalFree LoadLibraryA LocalReAlloc SetLastError GetStartupInfoA SetUnhandledExceptionFilter Sleep GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetModuleHandleA LoadLibraryW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection HeapFree

ntdll

vDbgPrintExWithPrefix

Sharing

General

Malware Config

Signatures

File Explorer

4fb836157d402746318c3172ab092b8d88b1df8dddc3bbb9c870959ae3bfb38f

user32

gdi32

shell32

comctl32

comdlg32

msvcrt

kernel32

ntdll

generic