edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba

Sharing

Copy URL Twitter E-mail

General

Target
edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba
Size 232KB
Sample260825-2ekqcszcmd
SHA256 edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba
MD5 77935e34a416330b85b94e0b6b6a529f
SHA1 94130f8a480a0334215c30e66fe3bfd1b2ecad56
SHA512 f27d08b58aacd5c58be7fac549783f39762af7ea38040962077aaa7a418daf3d55c5e11f95feeb70582611e05b55c52e85d757d096cadb475e0d03cecce5b6e0
SSDEEP 3072:x7sLFcVj0FjmlrrVp1lgCjPqZul3ll+h4kKdykhfvRPQxdIskfAO//VcZKXkPRB:18UjXhlJ+ZuxpwWv5Q8q
TLSH
T1EE347205D7E502C5F8F2977498715263B9B6BC20AB39DBCF9B00522D4E30AD0DE78B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba

File Explorer

edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba

.exe 232KB

edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba

IMPHASH ff92c63907ddceb2ba7e6fe973d163bf
SHA256 edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba
MD5 77935e34a416330b85b94e0b6b6a529f
SHA1 94130f8a480a0334215c30e66fe3bfd1b2ecad56
SHA512 f27d08b58aacd5c58be7fac549783f39762af7ea38040962077aaa7a418daf3d55c5e11f95feeb70582611e05b55c52e85d757d096cadb475e0d03cecce5b6e0
SSDEEP 3072:x7sLFcVj0FjmlrrVp1lgCjPqZul3ll+h4kKdykhfvRPQxdIskfAO//VcZKXkPRB:18UjXhlJ+ZuxpwWv5Q8q
TLSH
T1EE347205D7E502C5F8F2977498715263B9B6BC20AB39DBCF9B00522D4E30AD0DE78B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

R:\buildbot\output-VS-amd64\msvc_pdb\winlogon.pdb

user32

RegisterLogonProcess LoadKeyboardLayoutW GetMessageW GetDlgItemTextW DispatchMessageW SetWindowPos SetWindowPlacement SetThreadDesktop SetDlgItemTextW OpenInputDesktop TranslateMessage GetWindowPlacement GetUserObjectInformationW PostMessageA SetProcessWindowStation CreateWindowExW DefWindowProcA DeleteMenu DestroyWindow DialogBoxParamA EndDialog CloseWindowStation CreateDesktopW CreateWindowStationW DialogBoxIndirectParamW LoadStringW MessageBoxW GetWindowLongPtrW DialogBoxParamW CloseDesktop SetUserObjectSecurity wsprintfW SystemParametersInfoW GetLastInputInfo SetWindowStationUser SetLogonNotifyWindow UpdatePerUserSystemParameters UnregisterHotKey UnregisterClassW SwitchDesktop SetWindowLongPtrW SetTimer RegisterHotKey RegisterClassExW PostQuitMessage PostMessageW KillTimer GetWindowLongPtrA GetSystemMenu GetDesktopWindow ExitWindowsEx GetSystemMetrics

advapi32

RegSetValueExW CloseServiceHandle SetSecurityDescriptorDacl InitializeSecurityDescriptor AllocateAndInitializeSid RegQueryValueExA RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegOpenCurrentUser RegCreateKeyExW RegCloseKey RevertToSelf ImpersonateLoggedOnUser OpenSCManagerA OpenServiceW QueryServiceStatusEx SetEntriesInAclA CreateProcessAsUserW AddAccessAllowedAceEx FreeSid GetLengthSid MakeSelfRelativeSD InitializeAcl GetTokenInformation

userenv

UnloadUserProfile LoadUserProfileW CreateEnvironmentBlock DestroyEnvironmentBlock

rpcrt4

RpcServerUseProtseqEpW RpcServerRegisterIf RpcServerListen NdrServerCall2

mpr

WNetEnumResourceA WNetOpenEnumA WNetAddConnectionA WNetClearConnections WNetCloseEnum

msvcrt

_fpreset _initterm __initenv _acmdln signal _cexit __lconv_init exit __set_app_type __getmainargs _amsg_exit malloc iswctype wcschr wcscpy wcslen wcsncpy __C_specific_handler memset wcscmp memcmp memcpy strcpy strcmp strlen memmove strchr strcspn bsearch _snprintf sprintf swprintf __setusermatherr

kernel32

CreateThread CloseHandle Beep HeapFree HeapAlloc GetProcessHeap SetLastError LocalReAlloc LoadLibraryW GetEnvironmentVariableA SleepEx OpenEventW HeapReAlloc GetCurrentProcessId ExitProcess GetExitCodeProcess CreateProcessW WaitForMultipleObjects TerminateProcess ResetEvent GetTickCount CreateEventW WaitForSingleObject Sleep SetEvent LocalFree GetExitCodeThread GetProcAddress FreeLibrary ExpandEnvironmentStringsW GetStartupInfoA SetUnhandledExceptionFilter GetCurrentThreadId GetSystemTimeAsFileTime TlsGetValue QueryPerformanceCounter GetModuleHandleA DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection LocalAlloc GetLastError

ntdll

vDbgPrintExWithPrefix NtInitializeRegistry NtRaiseHardError RtlSetThreadIsCritical RtlSetProcessIsCritical NtQuerySystemTime NtShutdownSystem NtSetDefaultLocale RtlUnicodeStringToInteger RtlAdjustPrivilege RtlFreeHeap RtlAllocateHeap RtlAssert

Sharing

General

Malware Config

Signatures

File Explorer

edee7c3727ef431fc6af5f920650b575f9e3808499e9bb90e4709b66e05b13ba

user32

advapi32

userenv

rpcrt4

mpr

msvcrt

kernel32

ntdll

generic