39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523

General

Target
39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523
Size 5.6MB
Sample260826-vtf76atalc
SHA256 39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523
MD5 5973276cbd0862df980fac76d0a46863
SHA1 dddefb8450f3654b07b16aa447dc83611ea857ab
SHA512 07a53c0c65522fade0b5455514f38ef338288651c8d781168f90a4388c062ab84d4f62fc6ed1bacc9b1f5f95b92f3dc4587ea698ab70cb4555734d857895a964
SSDEEP 98304:R1LMRuhgqHsmSiTyvMCgBn0D65nyQQFVk65hG03hr6pqlZLerp3ja6qeFoQt:RtmuhIiTaMF0q9yzfG038UlZeHp7
TLSH
T1BB5612197F92E891D8561438287AE7C52EEAFDD0BDE09F3322CA275D1DBA1712DD2430
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523

File Explorer

39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523

.exe 5.6MB

39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523

IMPHASH d7eeb4d0d4fb8b9964ab3e010c8de4d1
SHA256 39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523
MD5 5973276cbd0862df980fac76d0a46863
SHA1 dddefb8450f3654b07b16aa447dc83611ea857ab
SHA512 07a53c0c65522fade0b5455514f38ef338288651c8d781168f90a4388c062ab84d4f62fc6ed1bacc9b1f5f95b92f3dc4587ea698ab70cb4555734d857895a964
SSDEEP 98304:R1LMRuhgqHsmSiTyvMCgBn0D65nyQQFVk65hG03hr6pqlZLerp3ja6qeFoQt:RtmuhIiTaMF0q9yzfG038UlZeHp7
TLSH
T1BB5612197F92E891D8561438287AE7C52EEAFDD0BDE09F3322CA275D1DBA1712DD2430
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6438992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Mt2Classic\Client\Client\binary.pdb

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE

Name

.rdata

Size

669KB

Virtual Size

668KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

133KB

Virtual Size

634KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

140KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bsh

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=43, id=224, productName=VS2013 build 21005, version=21005,

count=30, id=259, version=33145,

count=4, id=170, productName=VS2010 build 30319, version=30319,

count=5, id=265, version=35228,

count=219, id=261, version=33145,

count=2, id=262, version=33145,

count=58, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=1, id=48, version=9044,

count=7, id=206, productName=VS2012 UPD3 build 60610, version=60610,

count=125, id=207, productName=VS2012 UPD3 build 60610, version=60610,

count=2, id=257, productName=VS2015 [14.0] build 23026, version=23026,

count=66, id=261, version=31937,

count=1, id=253, version=35207,

count=41, id=259, version=35207,

count=18, id=260, version=35207,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=156, version=21202,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=101, id=261, version=35207,

count=1, id=260, version=35228,

count=54, id=260, version=33145,

count=29, id=257, version=33145,

count=538, id=1, productName=Unmarked objects,

count=320, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,

Sharing

General

Malware Config

Signatures

File Explorer

39719204cd9b463fb1ebb3bfe3a1a295d975891f10ae92e8fa8cedd0385c1523

bsclient

generic