ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050

Sharing

Copy URL Twitter E-mail

General

Target
ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050
Size 320KB
Sample260825-k64twazblc
SHA256 ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050
MD5 34c21a29ad167dbe4763580c14f705c1
SHA1 dc1a38c99a735caea3f239d4280201476ff8a1ce
SHA512 93a96dafed8e72e8701a8c88f5bc1d132dcd0b650fa465cc33ea42033e37bb83162b2ca27779d25c393db053167f30013ccbf4c6f3505b1bb4be7942b1b4d043
SSDEEP 3072:Lk8biKCkKhSbbwEa1TBZDmhUmcU1qBGaI+suh27clPu0uoMEwo9/vLAH:Q8bJtbbwEWG7uh2o4BEwo9/vLW
TLSH
T19964B540BA996883DD37967D05DA973E273CFBA0C3A38F07D9446B176D13AD02D9231A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050

File Explorer

ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050

.exe 320KB

ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050

IMPHASH 1eb1f239dabdb5bad1fa5dc9f6eeabe3
SHA256 ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050
MD5 34c21a29ad167dbe4763580c14f705c1
SHA1 dc1a38c99a735caea3f239d4280201476ff8a1ce
SHA512 93a96dafed8e72e8701a8c88f5bc1d132dcd0b650fa465cc33ea42033e37bb83162b2ca27779d25c393db053167f30013ccbf4c6f3505b1bb4be7942b1b4d043
SSDEEP 3072:Lk8biKCkKhSbbwEa1TBZDmhUmcU1qBGaI+suh27clPu0uoMEwo9/vLAH:Q8bJtbbwEWG7uh2o4BEwo9/vLW
TLSH
T19964B540BA996883DD37967D05DA973E273CFBA0C3A38F07D9446B176D13AD02D9231A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

gdi32

CreateCompatibleDC CreateDIBSection CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetTextExtentPointA GetTextExtentPointW GetTextMetricsW SelectObject SetBkMode SetTextColor

kernel32

CloseHandle CompareStringW CreateEventW CreateFileW CreateMutexW CreateProcessW CreateThread DelayLoadFailureHook DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetFullPathNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetStartupInfoW GetTickCount HeapAlloc HeapReAlloc InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW MapViewOfFile MulDiv MultiByteToWideChar OpenProcess ReadDirectoryChangesW ResolveDelayLoadedAPI SetThreadDescription UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject lstrcmpiW

ntdll

NtSetInformationProcess _vsnprintf

rpcrt4

UuidCreate

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf _assert _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _strdup _wcsicmp _wcsnicmp calloc exit free fwrite getenv iswspace malloc memcpy memmove memset realloc strchr strcmp strcspn strlen wcschr wcscmp wcscpy wcslen wcstoul

user32

AdjustWindowRect AppendMenuW BeginPaint ChangeDisplaySettingsExW ClientToScreen ClipCursor CopyIcon CreateDesktopW CreateIcon CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawCaptionTempW DrawFrameControl DrawIconEx DrawTextW EndPaint EnumDisplayDevicesW EnumDisplaySettingsExW ExitWindowsEx GetAncestor GetClientRect GetDC GetDesktopWindow GetForegroundWindow GetMenuInfo GetMenuItemCount GetMenuItemInfoW GetMessageW GetProcessWindowStation GetSystemMetrics GetThreadDesktop GetUserObjectInformationW GetWindow GetWindowLongW GetWindowRect GetWindowThreadProcessId InsertMenuItemW IntersectRect InvalidateRect IsIconic IsWindowEnabled IsWindowVisible KillTimer LoadCursorA LoadCursorW LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PaintDesktop PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW ReleaseDC SendMessageW SendNotifyMessageW SetCursor SetForegroundWindow SetMenuInfo SetMenuItemInfoW SetParent SetShellWindow SetThreadDesktop SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SubtractRect SystemParametersInfoW TrackPopupMenuEx TranslateMessage UnregisterClassW UpdateLayeredWindow UpdateWindow

win32u

NtUserMessageCall

Name

.text

Size

84KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

692B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee884b843e52cbd25efcc219b1d84dfb8e4ae910ad3d7049ca8ddff1ae002050

advapi32

gdi32

kernel32

ntdll

rpcrt4

ucrtbase

user32

win32u

generic