4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e

Sharing

Copy URL Twitter E-mail

General

Target
4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e
Size 843KB
Sample260825-xc563aae48
SHA256 4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e
MD5 6c901ac7404bc9453a0e2b503ca70b03
SHA1 b8f5fcddf24d2f93fed2c00e7220024c53f38020
SHA512 ace8e4f377cc39f1c563c51be6efbe883610967bbbcabbe453c072dfc249e8d4e2217f9305a17c3d4f1577629fd721fa365c21ee58b5619b15faba10ccea039e
SSDEEP 6144:VCSIS3ybiObUgFXoAsGyjYrgx+g1wYXqBuHBTpOdN86IpKIGAZTBO9NeVbOCC/sq:bISohjoAsGyjYrW+YXo
TLSH
T14E051D8477F8EF09F6AB9A3445789AD3483DBC915E23863AF73CF5190739DA09A14312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e

File Explorer

4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e

.dll 843KB

4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e

IMPHASH 10dbabdb8e01c3f4a229b66e7d274df2
SHA256 4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e
MD5 6c901ac7404bc9453a0e2b503ca70b03
SHA1 b8f5fcddf24d2f93fed2c00e7220024c53f38020
SHA512 ace8e4f377cc39f1c563c51be6efbe883610967bbbcabbe453c072dfc249e8d4e2217f9305a17c3d4f1577629fd721fa365c21ee58b5619b15faba10ccea039e
SSDEEP 6144:VCSIS3ybiObUgFXoAsGyjYrgx+g1wYXqBuHBTpOdN86IpKIGAZTBO9NeVbOCC/sq:bISohjoAsGyjYrW+YXo
TLSH
T14E051D8477F8EF09F6AB9A3445789AD3483DBC915E23863AF73CF5190739DA09A14312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint NtPowerInformation NtQueryInformationToken NtShutdownSystem RtlAdjustPrivilege RtlAllocateAndInitializeSid RtlAllocateHeap RtlEqualSid RtlFreeHeap RtlFreeSid RtlInitAnsiString RtlInitUnicodeString vDbgPrintExWithPrefix

advapi32

AllocateLocallyUniqueId CreateProcessAsUserW DuplicateTokenEx GetTokenInformation GetUserNameW ImpersonateLoggedOnUser LsaClose LsaFreeMemory LsaOpenPolicy LsaRetrievePrivateData OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf

kernel32

AllocConsole CloseHandle CreateEventW CreateSemaphoreW CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FlushConsoleInputBuffer GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentVariableA GetLastError GetLocalTime GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessHeap GetStdHandle GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LocalReAlloc MulDiv QueryPerformanceCounter RaiseException ReadConsoleW ReleaseSemaphore RtlUnwind SetConsoleMode SetEvent SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW lstrlenW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf _wcsicmp abort bsearch calloc free fwrite malloc memcmp memcpy memmove sprintf strchr strcmp strcpy strcspn strlen strncmp vfprintf wcscat wcschr wcscmp wcscpy wcslen wcstoul

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetObjectW GetStockObject SelectObject SetBkMode SetDIBits SetTextColor

user32

AdjustWindowRectEx BeginPaint CallWindowProcW ClientToScreen CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawStateW EnableWindow EndDialog EndPaint GetCapture GetClientRect GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemTextW GetKeyState GetParent GetSystemMetrics GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsWindow IsWindowVisible KillTimer LoadBitmapW LoadCursorW LoadImageW LoadStringW MapWindowPoints MessageBoxW MoveWindow PeekMessageW PostMessageW RegisterClassExW ReleaseCapture ReleaseDC SendDlgItemMessageW SendMessageW SetCapture SetCursor SetDlgItemTextW SetFocus SetForegroundWindow SetRect SetThreadDesktop SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TranslateMessage UnregisterClassW UpdateWindow WindowFromPoint wsprintfW

Name

.text

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

623KB

Virtual Size

622KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4ec9508365f6a8f01ce0b409e55961862d1746030ec331893978cdcab72c7b5e

ntdll

advapi32

kernel32

msvcrt

gdi32

user32

generic