061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857

Sharing

Copy URL Twitter E-mail

General

Target
061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857
Size 2.0MB
Sample260827-mh2eysshpe
SHA256 061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857
MD5 d574471363d8140c97fbf0148546bb34
SHA1 dd56dc7fe6226a536e80d343cf8906d99807209c
SHA512 5d71f3da824e8f8c038a52b72bc0f63259a3c84684987ab066db1b4b3d15bcd5c361da035d81fe996746b19bc3bf96f34f91969878242c420e8b87611c664528
SSDEEP 12288:g3zKVSuTNMvp4S2PN1AWTAaVeDPlwxKcgq0RzSA3zKT3zK40RzS:FU0K+JtTFkBXq3li43
TLSH
T1F7A5400253A20067E1A13970C47A7B580664BFF43D77E26AFD54701AFAB2BC558337BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857

File Explorer

061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857

.exe 2.0MB

061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857

IMPHASH e791258d96e10d4d21caa3d8d49afe49
SHA256 061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857
MD5 d574471363d8140c97fbf0148546bb34
SHA1 dd56dc7fe6226a536e80d343cf8906d99807209c
SHA512 5d71f3da824e8f8c038a52b72bc0f63259a3c84684987ab066db1b4b3d15bcd5c361da035d81fe996746b19bc3bf96f34f91969878242c420e8b87611c664528
SSDEEP 12288:g3zKVSuTNMvp4S2PN1AWTAaVeDPlwxKcgq0RzSA3zKT3zK40RzS:FU0K+JtTFkBXq3li43
TLSH
T1F7A5400253A20067E1A13970C47A7B580664BFF43D77E26AFD54701AFAB2BC558337BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13220

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\Acro_root_at\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb

kernel32

UnmapViewOfFile CreateFileA VirtualQueryEx GetCurrentProcess MapViewOfFile CreateFileMappingA GetFileAttributesA FindClose FindNextFileA FindFirstFileA ReadFile CloseHandle GetTempPathA GetWindowsDirectoryA GetSystemDirectoryA LoadLibraryA FreeLibrary GetProcAddress GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetSystemInfo IsDebuggerPresent OutputDebugStringA SetFilePointer GetVersionExA SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoA InterlockedCompareExchange Sleep InterlockedExchange GetSystemTimeAsFileTime

user32

FindWindowA SendMessageA MessageBoxA

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueA

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z

msvcr80

??0exception@std@@QAE@ABQBDH@Z ?what@exception@std@@UBEPBDXZ ??3@YAXPAX@Z ??0exception@std@@QAE@XZ _invalid_parameter_noinfo ??2@YAPAXI@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z strchr strrchr free strcpy malloc strlen strcmp ?terminate@@YAXXZ ??0exception@std@@QAE@ABQBD@Z __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _unlock __dllonexit _lock _onexit _decode_pointer _invoke_watson _controlfp_s __CxxFrameHandler3 _snprintf _amsg_exit ??1exception@std@@UAE@XZ

Sharing

General

Malware Config

Signatures

File Explorer

061d97cf93f2f1f266f22607cf32d30874e908916eb7c331cd77319bb7540857

kernel32

user32

advapi32

shell32

msvcp80

msvcr80

generic