ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9

Sharing

Copy URL Twitter E-mail

General

Target
ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9
Size 20KB
Sample260828-sxpmlade34
SHA256 ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9
MD5 246558d8b1d3719bc663465214db1624
SHA1 56e0f3f79403865a910c612e1932d3aa359042de
SHA512 5fad749bc5f934545efb0690d3ae23016ef083e4796ffa46d566013afef30a8c1b0b44a37c00cb93f7b59a3f75671658ba9733416cb531d6304432980c618890
SSDEEP 384:jWz8gKlgtYR8S+SAvg0X9KH6j81fCq18NTN/h7ge:jWYl6DS+SAIr8GfCqSx/xge
TLSH
T14892F91EB35304EDD516C274E6FBA733A6B0BC21087A5B2F4260C2741F74A96653CB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9

File Explorer

ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9

.exe 20KB

ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9

IMPHASH be39a2f9472577eabcc8e140cad3f06a
SHA256 ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9
MD5 246558d8b1d3719bc663465214db1624
SHA1 56e0f3f79403865a910c612e1932d3aa359042de
SHA512 5fad749bc5f934545efb0690d3ae23016ef083e4796ffa46d566013afef30a8c1b0b44a37c00cb93f7b59a3f75671658ba9733416cb531d6304432980c618890
SSDEEP 384:jWz8gKlgtYR8S+SAvg0X9KH6j81fCq18NTN/h7ge:jWYl6DS+SAIr8GfCqSx/xge
TLSH
T14892F91EB35304EDD516C274E6FBA733A6B0BC21087A5B2F4260C2741F74A96653CB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

comctl32

InitCommonControlsEx

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateProcessA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA EnterCriticalSection GetCurrentProcessId GetLastError GetModuleHandleA GetStartupInfoA GetTickCount InitializeCriticalSection LeaveCriticalSection MoveFileExA OpenProcess Process32First Process32Next SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WriteFile lstrcmpiA

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

strlen strncmp

shell32

SHGetFolderPathA

user32

CreateWindowExW DefWindowProcW DispatchMessageA GetMessageA LoadCursorA LoadIconA PostMessageA PostQuitMessage RegisterClassExW SendMessageA SetWindowTextW ShowWindow TranslateMessage UpdateWindow wsprintfA

wininet

DeleteUrlCacheEntryA InternetCloseHandle InternetOpenA InternetOpenUrlA InternetReadFile

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

460B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee56eded271c86143232e0ad10dac94a679cd91ce6b93278a20119b57bc72dd9

comctl32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

shell32

user32

wininet

generic