1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba

General

Target
1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba
Size 1.2MB
Sample260827-tktw8axfmc
SHA256 1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba
MD5 5d6dab38d65b52fd7111fd8c35cd7d42
SHA1 481627e5f6f8b392a8ca40916143ebb92c5ce749
SHA512 3ad8f542321db9a2f4808aec781bc8a69c9edeb1b4a4528506384b88ac54e0fc231a39eccefae6f61ecb82d47c1a39477d07589b95b7669e71e449e174c3058c
SSDEEP 24576:Ruv9tG4rC7pQ1Rp7te0gDsHgaeMGNsHG6VfSnnCj6qs+JvD7IdeW:+NhDNhUG7W
TLSH
T1E155D013C3C09B37C692603D3A6FB62D95ABB54F32A3AA44A60755FF5D762C324243C9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba

File Explorer

1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba

.exe 1.2MB

1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba

IMPHASH f2c11fd3930003ac63b6eca2113dfb82
SHA256 1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba
MD5 5d6dab38d65b52fd7111fd8c35cd7d42
SHA1 481627e5f6f8b392a8ca40916143ebb92c5ce749
SHA512 3ad8f542321db9a2f4808aec781bc8a69c9edeb1b4a4528506384b88ac54e0fc231a39eccefae6f61ecb82d47c1a39477d07589b95b7669e71e449e174c3058c
SSDEEP 24576:Ruv9tG4rC7pQ1Rp7te0gDsHgaeMGNsHG6VfSnnCj6qs+JvD7IdeW:+NhDNhUG7W
TLSH
T1E155D013C3C09B37C692603D3A6FB62D95ABB54F32A3AA44A60755FF5D762C324243C9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

cf:ba:4e:7d:26:bf:11:30:ae:82:16:fb:97:c7:fe:15

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=OOO_PLEIRIKS,O=OOO_PLEIRIKS,POSTALCODE=160009,STREET=Putejskaja\, 22,L=Vologda,ST=RU,C=RU

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

1231152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CloseHandle CreateEventW TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetTickCount GetCurrentThreadId GlobalFindAtomW SearchPathA FindFirstFileA GetTimeFormatA GlobalFlags GlobalUnlock DuplicateHandle CreateDirectoryA CompareFileTime GetDiskFreeSpaceA GetTempPathA RaiseException GetTimeZoneInformation GetConsoleCP GetShortPathNameA GetDateFormatA SetEndOfFile SetCurrentDirectoryA ExpandEnvironmentStringsA GetVolumeInformationW SetFileAttributesA GetFileAttributesA FindClose FlushFileBuffers lstrcmpiA GetExitCodeProcess GetDriveTypeW LockFile FindNextFileA WaitForMultipleObjects GlobalLock GetProcAddress GetLastError GetModuleHandleA GetStringTypeA LCMapStringW LCMapStringA MultiByteToWideChar LoadLibraryA HeapReAlloc HeapAlloc GetOEMCP GetACP GetCPInfo RtlUnwind GetStringTypeW HeapFree VirtualFree HeapCreate HeapDestroy GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA GetModuleFileNameA UnhandledExceptionFilter GetCurrentProcess ExitProcess GetVersion GetCommandLineA GetStartupInfoA GetOverlappedResult WriteFile VirtualAlloc GetVersionExA CreateThread InterlockedExchange WaitForSingleObject

user32

ShowWindow SetCursor GetSystemMenu IsWindowEnabled CallWindowProcA CharPrevA LoadCursorA TrackPopupMenu CheckDlgButton GetMessagePos MessageBoxIndirectA LoadBitmapA SendMessageTimeoutA GetWindowLongA SetClipboardData CreatePopupMenu EndDialog BeginPaint EndPaint DrawTextA CloseClipboard AppendMenuA InvalidateRect DefWindowProcA SetWindowPos EnableMenuItem IsWindowVisible GetSysColor GetWindowRect GetSystemMetrics EmptyClipboard

gdi32

GetStockObject SetBkMode SetTextColor GetDeviceCaps DeleteObject

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

29.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

a86b5

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1390ca1eb2d0b7672fe5bc101bd0256046c9c3011139d3d2777a19f3fd8e8dba

PE Signature issue

kernel32

user32

gdi32

generic