2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b

Sharing

Copy URL Twitter E-mail

General

Target
2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b
Size 2.1MB
Sample260831-fd4aesxtas
SHA256 2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b
MD5 69695f3526b47e427eb4cd4204fba79b
SHA1 fc63b3696d92a2ea816c9760b905870f71c87100
SHA512 b9a6647fa44923bb34e55f4c743afcba3710f0cf8df6537630cd22f28cf219b1eb7a6ff5b2603cda501c75356e6766c0ce07651c7e98a62121e058c041e5ab1f
SSDEEP 49152:suq6k6MIsD2Hwtobx8A7dwxHTvej5nVTBag:/q6Ptwto18JpTvej5nVTMg
TLSH
T1F3A5E134EEAB70E6ECCB00FC5F177161A4227DE38A2C79B7E5D0B6521119DD81A36236
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b

File Explorer

2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b

.exe 2.1MB

2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b

IMPHASH c4b185fc6a9ca983e00f1684a13ef4e1
SHA256 2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b
MD5 69695f3526b47e427eb4cd4204fba79b
SHA1 fc63b3696d92a2ea816c9760b905870f71c87100
SHA512 b9a6647fa44923bb34e55f4c743afcba3710f0cf8df6537630cd22f28cf219b1eb7a6ff5b2603cda501c75356e6766c0ce07651c7e98a62121e058c041e5ab1f
SSDEEP 49152:suq6k6MIsD2Hwtobx8A7dwxHTvej5nVTBag:/q6Ptwto18JpTvej5nVTMg
TLSH
T1F3A5E134EEAB70E6ECCB00FC5F177161A4227DE38A2C79B7E5D0B6521119DD81A36236
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

815336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcesses LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

CreateWindowExW DispatchMessageW GetMessageW LoadCursorW TranslateMessage

Name

.text

Size

938KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.eof

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2304b74766101034ddf9e7be3c5ccf3fe22273a8b3181e6d755d6588a39ba49b

kernel32

user32

generic