ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24

General

Target
ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24
Size 1.6MB
Sample260827-nadvcstdmg
SHA256 ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24
MD5 d5cb7f8a305a9601166458fb8ac02716
SHA1 4805a53639fe506c2a65c715d8197933afad7ca5
SHA512 d3c9cdb828749a1ba172445ecdebba8f2869ce1bd3f604defa4a7e765fee0c31236e68863b8040264e708110d00eb87e947e5fbb177c1949b2ab39df1f9e853a
SSDEEP 49152:BXql1ivqFJsa5PnxnVjkW/ouWjQemVoG7DfbBRgGE:BXqo+nxuW/oNQvoB
TLSH
T19B751200EA009131E5B305FAC9EE777E653CBBA1D71558DB63C81E9D4BB22E17A31263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24

File Explorer

ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24

.exe 1.6MB

ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24

IMPHASH 266cb336ed6b96259291e3c9528ced14
SHA256 ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24
MD5 d5cb7f8a305a9601166458fb8ac02716
SHA1 4805a53639fe506c2a65c715d8197933afad7ca5
SHA512 d3c9cdb828749a1ba172445ecdebba8f2869ce1bd3f604defa4a7e765fee0c31236e68863b8040264e708110d00eb87e947e5fbb177c1949b2ab39df1f9e853a
SSDEEP 49152:BXql1ivqFJsa5PnxnVjkW/ouWjQemVoG7DfbBRgGE:BXqo+nxuW/oNQvoB
TLSH
T19B751200EA009131E5B305FAC9EE777E653CBBA1D71558DB63C81E9D4BB22E17A31263
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

80717

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess GetLastError GetProcAddress GetTempFileNameA GetLocalTime LoadLibraryA GetModuleFileNameA GetModuleHandleA CloseHandle GetTempPathA DeleteFileA GetFullPathNameA GetThreadContext CreateFileA GetCurrentThread IsBadReadPtr ExpandEnvironmentStringsA GetExitCodeProcess GetFileAttributesA GetEnvironmentVariableA MultiByteToWideChar CreateDirectoryA FindFirstFileA RemoveDirectoryA FindClose GetCurrentDirectoryA GetCurrentProcessId GetVolumeInformationW GetFileSize MapViewOfFile UnmapViewOfFile WriteFile SetLastError CreateFileMappingA WaitForSingleObject SystemTimeToFileTime CreateProcessW MoveFileExA WideCharToMultiByte CreateFileW HeapFree HeapAlloc GetCommandLineA GetProcessHeap InterlockedDecrement ExitProcess GetModuleHandleExW GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent HeapSize Sleep InterlockedIncrement GetCurrentThreadId RaiseException IsDebuggerPresent IsValidCodePage GetACP GetOEMCP GetCPInfo EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind GetConsoleMode SetFilePointerEx GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW OutputDebugStringW LoadLibraryW HeapReAlloc LCMapStringW GetStringTypeW GetConsoleCP SetStdHandle FlushFileBuffers WriteConsoleW VirtualQuery

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24

kernel32

advapi32

shell32

generic