dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6

General

Target
dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6
Size 497KB
Sample260825-e2v4aasxev
SHA256 dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6
MD5 4b3c1e1b65bd901df90c3d35a5ac6713
SHA1 fcb81fc744439f3af946018d438fd0b1def419c8
SHA512 a694b81dc486ebd4b1ff0d9b10f976a69661bd53f4914a0de4c2a9acdb5fe3e975c874fec266cfdd1d55cf1e3a86cfb20f18e461a331a1ac26049390e0339f62
SSDEEP 6144:/y8m9NczPx+i4I42I4w18jMhihTIv04I42I4w18jMhihTIv:68m9N8PDh423gAXh423gA
TLSH
T103B42962A22D38ADC16384FD53BE0CF60D1B49A41923357B5EA47E1FC61131F8E76A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6

File Explorer

dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6

.exe 497KB

dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6

IMPHASH 1bdb78ec9d9a418c50c4cf75b093e55f
SHA256 dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6
MD5 4b3c1e1b65bd901df90c3d35a5ac6713
SHA1 fcb81fc744439f3af946018d438fd0b1def419c8
SHA512 a694b81dc486ebd4b1ff0d9b10f976a69661bd53f4914a0de4c2a9acdb5fe3e975c874fec266cfdd1d55cf1e3a86cfb20f18e461a331a1ac26049390e0339f62
SSDEEP 6144:/y8m9NczPx+i4I42I4w18jMhihTIv04I42I4w18jMhihTIv:68m9N8PDh423gAXh423gA
TLSH
T103B42962A22D38ADC16384FD53BE0CF60D1B49A41923357B5EA47E1FC61131F8E76A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Code\wins\x86\vRemoteApp\vDesktopServ\SangforInstaller\Release\SangforInstaller.pdb

kernel32

FindResourceW LoadResource CreateProcessW CreateDirectoryW WaitForSingleObject WriteFile SizeofResource GetExitCodeProcess CreateFileW GetLocalTime LockResource SetCurrentDirectoryW CloseHandle DeleteFileW ExpandEnvironmentStringsW GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer GetProcAddress GetModuleHandleW ExitProcess GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetLastError InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapFree Sleep MultiByteToWideChar LoadLibraryW RtlUnwind SetStdHandle WriteConsoleW IsProcessorFeaturePresent LCMapStringW GetStringTypeW HeapAlloc HeapReAlloc HeapSize FlushFileBuffers

Sharing

General

Malware Config

Signatures

File Explorer

dc8ad933a7ece5b2677b56ccbd7bc76289e85e5613c0123559376846e9c0a7e6

kernel32

generic