d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8

General

Target
d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8
Size 1.5MB
Sample260828-j2cddscc58
SHA256 d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8
MD5 2d72cc3df54a86f74670f1e183025551
SHA1 4816feb74eaff05e9c3446936e55943a2a0e7c0d
SHA512 b7f1ca8f54d64a6154f139584e154cf8f05eb05c589b8880c9957d14d660d7bb720f6ae5b1b418e52d7ecb538371a9bcf3f6face98f17609d3ffc79c7adcd06b
SSDEEP 49152:rN2oAjMgSkKr4ml0sJZk+fOZxVhNdOnyq2D3:rNoM/kq4a0sJm0ObPOnyqC3
TLSH
T128752200F620D239D8F3013959F9967504A8BE51CB6969EB77C86F0D4BBA1E1BB30367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8

File Explorer

d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8

.exe 1.5MB

d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8

IMPHASH 440d3db4faf888398573094fda651045
SHA256 d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8
MD5 2d72cc3df54a86f74670f1e183025551
SHA1 4816feb74eaff05e9c3446936e55943a2a0e7c0d
SHA512 b7f1ca8f54d64a6154f139584e154cf8f05eb05c589b8880c9957d14d660d7bb720f6ae5b1b418e52d7ecb538371a9bcf3f6face98f17609d3ffc79c7adcd06b
SSDEEP 49152:rN2oAjMgSkKr4ml0sJZk+fOZxVhNdOnyq2D3:rNoM/kq4a0sJm0ObPOnyqC3
TLSH
T128752200F620D239D8F3013959F9967504A8BE51CB6969EB77C86F0D4BBA1E1BB30367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

74518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleFileNameA GetModuleHandleA CloseHandle DeleteFileA GetFullPathNameA GetThreadContext GetCurrentThread IsBadReadPtr ExpandEnvironmentStringsA WideCharToMultiByte GetFileAttributesA GetEnvironmentVariableA MultiByteToWideChar CreateDirectoryA FindFirstFileA CreateFileMappingA RemoveDirectoryA FindClose LoadLibraryA GetCurrentDirectoryA GetCurrentProcessId GetTempPathA GetVolumeInformationW MoveFileExA CreateProcessW SystemTimeToFileTime WaitForSingleObject GetExitCodeProcess TerminateProcess GetLastError GetTempFileNameA GetLocalTime SetLastError WriteFile UnmapViewOfFile MapViewOfFile GetFileSize GetProcAddress CreateFileA CreateFileW HeapFree HeapAlloc GetCommandLineA IsProcessorFeaturePresent InterlockedDecrement ExitProcess GetModuleHandleExW HeapSize Sleep GetStdHandle GetModuleFileNameW RaiseException GetProcessHeap IsDebuggerPresent InterlockedIncrement IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind GetConsoleMode SetFilePointerEx GetFileType DeleteCriticalSection GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW HeapReAlloc OutputDebugStringW LoadLibraryW LCMapStringW GetStringTypeW GetConsoleCP SetStdHandle FlushFileBuffers WriteConsoleW VirtualQuery

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer

d8cd5a605915fb6ef6e578869e1f6711e4626299de3c0e1771cd2e6f2c090ba8

kernel32

advapi32

shell32

generic