235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82

Sharing

Copy URL Twitter E-mail

General

Target
235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82
Size 882KB
Sample260825-m2h3qaxtfv
SHA256 235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82
MD5 ada3b5db1bc75261e6ef7cde5b0bedee
SHA1 47e11012c47e90e74f961deb7b2ac8edf3ae3b73
SHA512 eeee92461a2e8bbc2a2d41f076cd3117edb385b07b0245070949babd4f4740286f67a777bcf881c2691093707d36c103c1676f173509d062e62c0b4005c16b9e
SSDEEP 24576:QKvrip9BCME8s5qtaBp1ZZKOKB0k6zF1+y:Qis9BF1oLNKZ
TLSH
T12E158D1919A1DE38E0F578B4532EA17D5A28D71C2B1077CB126528FC9DA31E5EA323F3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82

File Explorer

235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82

.exe 882KB

235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82

IMPHASH 712ee6fbfc0d663a60c12656fa2a8016
SHA256 235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82
MD5 ada3b5db1bc75261e6ef7cde5b0bedee
SHA1 47e11012c47e90e74f961deb7b2ac8edf3ae3b73
SHA512 eeee92461a2e8bbc2a2d41f076cd3117edb385b07b0245070949babd4f4740286f67a777bcf881c2691093707d36c103c1676f173509d062e62c0b4005c16b9e
SSDEEP 24576:QKvrip9BCME8s5qtaBp1ZZKOKB0k6zF1+y:Qis9BF1oLNKZ
TLSH
T12E158D1919A1DE38E0F578B4532EA17D5A28D71C2B1077CB126528FC9DA31E5EA323F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

138095

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

replmerg.pdb

msvcr80

_decode_pointer _onexit _lock __dllonexit _unlock _except_handler4_common __set_app_type _encode_pointer __p__fmode __p__commode _adjust_fdiv __setusermatherr ?terminate@@YAXXZ _initterm_e _initterm __initenv _wmakepath_s _vsnwprintf_l exit _XcptFilter _exit _cexit __getmainargs _amsg_exit _snwprintf_s _invoke_watson _controlfp_s _configthreadlocale ??3@YAXPAX@Z swscanf_s _wtol wcstok _wsplitpath_s wcsncmp swscanf wprintf _wsystem _beginthreadex _local_unwind4 _waccess wcsftime _localtime64 _time64 strncpy_s strcat_s strcpy_s sprintf_s _swprintf_c wcsrchr memcpy iswalpha _wcsnicmp swprintf_s _vsnwprintf_s _wtoi __CxxFrameHandler3 _CxxThrowException memmove _itow_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ _wcsicmp iswspace iswxdigit _vsnwprintf wcsstr wcschr wcsncat_s __iob_func freopen printf fclose memset _recalloc ??2@YAPAXI@Z _resetstkoflw _strnicmp ??_V@YAXPAX@Z ??_U@YAPAXI@Z _purecall wcscat_s wcsncpy_s wcscpy_s memcpy_s free malloc

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegQueryValueExW DeregisterEventSource ReportEventW RegisterEventSourceW

kernel32

GetVersionExW GetSystemDefaultLCID GetProcAddress GetVersionExA GetThreadLocale GetLocaleInfoA GetACP FormatMessageW LoadLibraryW FormatMessageA GetSystemDefaultLangID GetFileSize CreateFileW GetSystemInfo MapViewOfFile UnmapViewOfFile ReadFile CreateFileMappingA SetEnvironmentVariableW GetEnvironmentVariableW OutputDebugStringW GetUserDefaultLCID GetTimeFormatW GetFileSizeEx lstrcatW lstrcpyW CompareStringW HeapAlloc HeapFree HeapReAlloc GetProcessHeap VirtualFree HeapCreate VirtualQuery ReadProcessMemory SetHandleInformation GetExitCodeProcess CreateProcessW GetStartupInfoW SetThreadPriority GetThreadPriority InterlockedCompareExchange InterlockedExchange UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetDateFormatW GetLocalTime SetLastError CreateMutexW SetFilePointer ReleaseMutex MoveFileExW GetCurrentThread lstrlenW RaiseException InitializeCriticalSection DeleteCriticalSection GetLastError lstrcmpiW WideCharToMultiByte SetEvent EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement GetModuleFileNameW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleHandleW CloseHandle WaitForMultipleObjects WaitForSingleObject ResetEvent SetConsoleScreenBufferSize GetConsoleScreenBufferInfo SetConsoleCtrlHandler AllocConsole WriteFile GetStdHandle GetCurrentThreadId CreateEventA GetModuleFileNameA GetCommandLineA GetModuleHandleA Sleep GetCommandLineW GetCurrentProcessId ExitProcess CreateEventW SetUnhandledExceptionFilter HeapSetInformation GetExitCodeThread GetComputerNameW SetErrorMode GetSystemTime

odbc32

ord20 ord1 ord141 ord3 ord107 ord154 ord132 ord29 ord4 ord147 ord145 ord15 ord16 ord5 ord43 ord72 ord2 ord139 ord51 ord18 ord14 ord9 ord23 ord110 ord111 ord119 ord12 ord13 ord61 ord127 ord74 ord138 ord106

user32

MessageBoxA CharLowerW UnregisterClassA LoadStringW CharNextW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoTaskMemFree CoInitializeSecurity CoRevokeClassObject CoInitializeEx CoCreateGuid CoTaskMemRealloc CoTaskMemAlloc CLSIDFromProgID CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoGetMalloc CoRegisterClassObject

oleaut32

SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr LoadRegTypeLi VariantClear VariantCopy VariantInit SysStringLen GetErrorInfo

sqlncli10

bcp_control bcp_exec bcp_columns bcp_colfmt bcp_initW

instapi10

GetCOMPath

mpr

WNetGetUniversalNameW WNetGetUniversalNameA

Sharing

General

Malware Config

Signatures

File Explorer

235fb358358f34a91bb96e87d1cda563f8dd3aeca6da713b2eedc21520f36a82

msvcr80

advapi32

kernel32

odbc32

user32

ole32

oleaut32

sqlncli10

instapi10

mpr

generic