8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9

Sharing

Copy URL Twitter E-mail

General

Target
8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9
Size 8.1MB
Sample260825-plcbcaaj3w
SHA256 8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9
MD5 b39dc7fee3695d5a48cdde2a17fb7c7a
SHA1 69f8fbdcd3a4cdb7d001681fb5d638f7c96ee63b
SHA512 b5983be0e8ff2faab49ee10b0d78ecf3dfb62af19bcddc1812dc2600467c468825be1074f719c89b8d26e74630478de434b9f8fcb24f706ea307e3592563314d
SSDEEP 98304:gQnDcgj7G8B+bPgwn6RIpxrXGxqvO/cPYF:g4hLwRpFvqcAF
TLSH
T129866B0277EC0468F1F32B388A7A99609A37BC560B34D9DF12985D5D0E33AC19D76B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9

File Explorer

8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9

.exe 8.1MB

8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9

IMPHASH e559f006bfbdd79029ef7c1b31aa71a1
SHA256 8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9
MD5 b39dc7fee3695d5a48cdde2a17fb7c7a
SHA1 69f8fbdcd3a4cdb7d001681fb5d638f7c96ee63b
SHA512 b5983be0e8ff2faab49ee10b0d78ecf3dfb62af19bcddc1812dc2600467c468825be1074f719c89b8d26e74630478de434b9f8fcb24f706ea307e3592563314d
SSDEEP 98304:gQnDcgj7G8B+bPgwn6RIpxrXGxqvO/cPYF:g4hLwRpFvqcAF
TLSH
T129866B0277EC0468F1F32B388A7A99609A37BC560B34D9DF12985D5D0E33AC19D76B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1659881

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

LCMapStringA FreeLibrary GetModuleFileNameA GetCommandLineA IsBadReadPtr SetStdHandle IsBadCodePtr GetStringTypeW HeapFree HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap GetProcAddress LoadLibraryA lstrcpynW GetStringTypeA SetUnhandledExceptionFilter lstrcpyn RtlMoveMemory LCMapStringW VirtualAlloc VirtualFree GetCurrentThreadId GetCurrentThread lstrcmpiA lstrcmpA GlobalDeleteAtom GlobalAlloc GlobalLock CloseHandle LocalAlloc LocalFree InitializeCriticalSection TlsAlloc DeleteCriticalSection GlobalFree GlobalUnlock GlobalHandle TlsFree LeaveCriticalSection GlobalReAlloc EnterCriticalSection TlsSetValue LocalReAlloc TlsGetValue InterlockedDecrement SetErrorMode lstrcatA lstrcpyA lstrcpynA lstrlenA GetVersion GlobalFlags WritePrivateProfileStringA InterlockedIncrement WideCharToMultiByte MultiByteToWideChar SetLastError GetLastError GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetProcessVersion GetCurrentProcess WriteFile SetFilePointer FlushFileBuffers GetCPInfo GetOEMCP RtlUnwind TerminateProcess RaiseException HeapSize GetACP SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate IsBadWritePtr

user32

LoadStringA GetSysColorBrush LoadCursorA LoadIconA MapWindowPoints GetSysColor PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA PostQuitMessage PostMessageA SendMessageA SetCursor EnableWindow GetWindowLongA IsWindowEnabled GetLastActivePopup GetParent SetWindowsHookExA GetCursorPos IsWindowVisible ValidateRect CallNextHookEx GetKeyState GetActiveWindow GetNextDlgTabItem GetFocus EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions UnhookWindowsHookEx UnregisterClassA GetClassNameA PtInRect GetWindowRect GetDlgCtrlID GetWindow ClientToScreen SetWindowTextA GetWindowTextA GetMenuItemCount GetDC ReleaseDC TabbedTextOutA DrawTextA GrayStringA DestroyMenu GetDlgItem SetWindowLongA SetWindowPos ShowWindow SetFocus GetSystemMetrics GetWindowPlacement IsIconic SystemParametersInfoA RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA DestroyWindow GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect GetClientRect AdjustWindowRectEx

gdi32

Escape ExtTextOutA TextOutA RectVisible PtVisible GetObjectA GetStockObject CreateBitmap DeleteObject DeleteDC SaveDC RestoreDC SelectObject SetBkColor SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox GetDeviceCaps

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegCreateKeyExA RegCloseKey RegSetValueExA RegOpenKeyExA

comctl32

ord17

Name

EProtect

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

512B

Virtual Size

57B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

916KB

Virtual Size

915KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EProtect

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

8e784aeb73da217c898dff0a14af16e0a5643bfec517c75dd455d9c47b29def9

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

generic