6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac

Sharing

Copy URL Twitter E-mail

General

Target
6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac
Size 380KB
Sample260829-2p5hhshf75
SHA256 6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac
MD5 3fc3def2cdd895207bee1eb0ac27c3fd
SHA1 1810a8f27e28c1261e570f2ce509b3d71d235401
SHA512 e4d816482d265c74641fcc8ee2319a981d08704aab79b35532374e089d80354c24a93fbd9620171d041bd6bb77da0e5f6f103e6b983b3a6927cc4eacf41a5bc8
SSDEEP 3072:voAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:v7vJN/CE/TZINiPPBIwcuWTegi9W
TLSH
T1CC84123BF6A418C3E6B63A3014FDE15829A8952C3552AE3BB40613DD2F662C44FF5B58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac

File Explorer

6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac

.exe 380KB

6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac

IMPHASH a0f41bd5de82cbb844f692b48ffd09bd
SHA256 6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac
MD5 3fc3def2cdd895207bee1eb0ac27c3fd
SHA1 1810a8f27e28c1261e570f2ce509b3d71d235401
SHA512 e4d816482d265c74641fcc8ee2319a981d08704aab79b35532374e089d80354c24a93fbd9620171d041bd6bb77da0e5f6f103e6b983b3a6927cc4eacf41a5bc8
SSDEEP 3072:voAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:v7vJN/CE/TZINiPPBIwcuWTegi9W
TLSH
T1CC84123BF6A418C3E6B63A3014FDE15829A8952C3552AE3BB40613DD2F662C44FF5B58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AddAtomA GetFileTime GetPriorityClass OpenMutexW lstrcatA GetShortPathNameW GlobalFindAtomW GetWindowsDirectoryW GetProcAddress GetDateFormatW CreateMutexA GetModuleHandleA CopyFileA lstrcmpW CreateFileMappingW FindAtomW GetLastError GetExpandedNameA OpenEventA GetUserDefaultLangID CreateFileMappingA CreateDirectoryA ReadDirectoryChangesW GetCurrentDirectoryA lstrcmpA FatalAppExitW SetEvent GetEnvironmentStringsW GetExpandedNameW lstrlenA GetNumberFormatW GetFileType EnumDateFormatsW DosDateTimeToFileTime GetStringTypeA lstrcmpW IsBadReadPtr EndUpdateResourceA TlsAlloc OpenSemaphoreW GetStartupInfoW GetCurrentProcess GetFullPathNameA GetTickCount GetHandleInformation GetCurrentThread GetTempPathW OpenEventW GetFullPathNameW EnumTimeFormatsW GetVolumeInformationW FatalAppExitA lstrcpyA lstrlenW CreateNamedPipeW lstrcmp FileTimeToSystemTime GetAtomNameW DisconnectNamedPipe

user32

CharNextW EnumDesktopsW MessageBeep DialogBoxParamA GetClassNameW CallWindowProcA InsertMenuItemA SetCursor FlashWindow WaitForInputIdle EnumDesktopsA RegisterClassExW ChildWindowFromPoint LoadBitmapW CharLowerA GetForegroundWindow DrawTextW UnregisterClassA CopyImage CreateDialogParamA GetDlgItemInt CopyRect SetWindowLongW DefDlgProcW SetWindowTextW EnableMenuItem CreateDialogParamW GetScrollPos GetSysColor GetMenuItemInfoA RegisterClassA LoadImageW DialogBoxParamW DefWindowProcA GetClassInfoW PeekMessageW GetDC DefFrameProcW GetClassInfoExW wvsprintfA GetWindowTextLengthA DeleteMenu CopyIcon SetCursorPos SendMessageW FindWindowW CreatePopupMenu ActivateKeyboardLayout LoadCursorW IsIconic wvsprintfW MessageBoxA GetSubMenu SetDlgItemTextA IsWindow

gdi32

SelectClipPath SetROP2 SetDIBits CreateFontW GetFontData GetDeviceCaps GetArcDirection GetGraphicsMode CloseMetaFile SetViewportOrgEx EnumFontFamiliesW EnumFontFamiliesExW ExtEscape CreateSolidBrush GetClipRgn GetPaletteEntries CreateMetaFileA GetEnhMetaFileHeader RemoveFontResourceW GetICMProfileW GetCharABCWidthsFloatA

advapi32

RegSetValueA RegEnumValueW RegEnumKeyW RegFlushKey RegDeleteKeyW RegRestoreKeyW RegDeleteValueA RegQueryInfoKeyA

shell32

StrNCmpIA StrCmpNIW ShellExecuteW SHBrowseForFolderW

comdlg32

PrintDlgA GetFileTitleW PrintDlgExA PageSetupDlgW ReplaceTextA ReplaceTextW GetSaveFileNameW ChooseFontA PrintDlgExW PageSetupDlgA LoadAlterBitmap

ole32

CoGetClassObject GetClassFile CoGetInstanceFromIStorage BindMoniker CoGetDefaultContext OleUninitialize CoCreateInstance CoGetMalloc

ws2_32

WSADuplicateSocketW send getservbyport WSADuplicateSocketA accept gethostname

winmm

mixerClose midiInAddBuffer PlaySound midiInPrepareHeader midiInGetID mmioAscend waveInGetNumDevs mmioClose

winspool.drv

EnumPrintProcessorsW EnumPrintersA StartDocDlgA EnumPrintProcessorsA ConvertAnsiDevModeToUnicodeDevmode StartPagePrinter GetPrintProcessorDirectoryW AddPrinterW SetPrinterDataA

inetcomm

EssReceiptRequestDecodeEx MimeOleParseMhtmlUrl EssSecurityLabelEncodeEx MimeOleGetCodePageInfo MimeOleSMimeCapAddSMimeCap MimeOleOpenFileStream MimeOleSMimeCapGetEncAlg MimeEditDocumentFromStream

oledlg

OleUIObjectPropertiesA OleUIEditLinksW OleUIInsertObjectA OleUIPasteSpecialA OleUIChangeSourceA OleUIBusyW OleUIChangeIconW OleUIInsertObjectW

wsock32

WSAStartup GetNameByTypeW WSASetBlockingHook EnumProtocolsA htons WSAStartup select send

Name

.rdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.edata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6ed679cb9e8c6c91132e4232bbe646f2195619f001cad28e29d793ab2d4335ac

kernel32

user32

gdi32

advapi32

shell32

comdlg32

ole32

ws2_32

winmm

winspool.drv

inetcomm

oledlg

wsock32

generic