7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938

General

Target
7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938
Size 672KB
Sample260826-j4e73avdrd
SHA256 7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938
MD5 bd71bba201c29636dfa35083fa9af18f
SHA1 47f6829d0580deee73c0d7820bae2d01d1b7d441
SHA512 c9a7226c397b8ff50512ee0e29d0c5a944ebfc499d76ca1a5875eea38340895562c85bcb6e744c7a98abc1dc2ea34810af3aa85437547a4f27a5ab045da2073e
SSDEEP 12288:ereJQSXMNIWjpO7mYpcXFn07W5kl5A9S9o/OGZ7i9R5ZH66khI:ereJQSXMeWVOrm1N5kl5A9wBGhi9RPE2
TLSH
T16DE4F100B855C439D5BF027256F98B701EBC787217A98CDBF3C81E595930AC2B77A63A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938

File Explorer

7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938

.dll 672KB

7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938

IMPHASH 5c7beb146adf2ff187627cbc2994425e
SHA256 7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938
MD5 bd71bba201c29636dfa35083fa9af18f
SHA1 47f6829d0580deee73c0d7820bae2d01d1b7d441
SHA512 c9a7226c397b8ff50512ee0e29d0c5a944ebfc499d76ca1a5875eea38340895562c85bcb6e744c7a98abc1dc2ea34810af3aa85437547a4f27a5ab045da2073e
SSDEEP 12288:ereJQSXMNIWjpO7mYpcXFn07W5kl5A9S9o/OGZ7i9R5ZH66khI:ereJQSXMeWVOrm1N5kl5A9wBGhi9RPE2
TLSH
T16DE4F100B855C439D5BF027256F98B701EBC787217A98CDBF3C81E595930AC2B77A63A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

94823

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WideCharToMultiByte GetTickCount GetModuleFileNameW GetModuleHandleW LoadLibraryW GetLastError GetSystemDirectoryW GetProcAddress CloseHandle CreateFileW MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent RaiseException RtlUnwind GetSystemTimeAsFileTime HeapFree HeapAlloc GetCPInfo ExitProcess GetModuleHandleExW GetCommandLineA GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize IsValidCodePage GetACP GetOEMCP GetProcessHeap GetStdHandle WriteFile LoadLibraryExW GetFileType GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx OutputDebugStringW SetStdHandle WriteConsoleW FlushFileBuffers

advapi32

CheckTokenMembership AllocateAndInitializeSid FreeSid

shell32

ShellExecuteExW

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

267KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7fdf9078cfcfcf9d7987cd312762a74b8a3f7e8ad5ac5a8e847145bf13b17938

kernel32

advapi32

shell32

generic