3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06

Sharing

Copy URL Twitter E-mail

General

Target
3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06
Size 422KB
Sample260831-fehecavdnf
SHA256 3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06
MD5 52d97d21742e2418a4c23ccfd1b1e3d3
SHA1 4b9c9c751dc64228c82cb974a6bd4ff236b505e2
SHA512 3110357baf0930a2cc87a272737ee67d8f6dac76a016a4414a782ec303ea0d778a8d2cddcfd90269693ecccac633cf9bf81694b239559261fa19a65f0ce4e3f6
SSDEEP 6144:cM7HJcufNK99Fye+1Wm9PkFpQXB237oWVSl8txoPGzu8/AHAfhpQ0XJMo5:LrJ1NqiPkxsWs6oPWuWppQ0Xv
TLSH
T147947C29E76500F9D1A7C238CA434512EA727C4A4370EEDF13E49E661F276E09E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06

File Explorer

3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06

.exe 422KB

3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06

IMPHASH c79fea5a36c0f1c31b6c1cdf228e9c48
SHA256 3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06
MD5 52d97d21742e2418a4c23ccfd1b1e3d3
SHA1 4b9c9c751dc64228c82cb974a6bd4ff236b505e2
SHA512 3110357baf0930a2cc87a272737ee67d8f6dac76a016a4414a782ec303ea0d778a8d2cddcfd90269693ecccac633cf9bf81694b239559261fa19a65f0ce4e3f6
SSDEEP 6144:cM7HJcufNK99Fye+1Wm9PkFpQXB237oWVSl8txoPGzu8/AHAfhpQ0XJMo5:LrJ1NqiPkxsWs6oPWuWppQ0Xv
TLSH
T147947C29E76500F9D1A7C238CA434512EA727C4A4370EEDF13E49E661F276E09E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

131408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup WSAGetLastError setsockopt htons recv connect socket send inet_pton select closesocket WSAStartup

gdi32

SelectObject CreateCompatibleBitmap BitBlt SetStretchBltMode DeleteDC StretchBlt DeleteObject CreateCompatibleDC

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdiplusStartup GdipSaveImageToStream

wininet

InternetOpenA InternetReadFile InternetCloseHandle InternetOpenUrlA

kernel32

GetFileAttributesExW CreateProcessW GetExitCodeProcess LCMapStringW CompareStringW VirtualProtect GetConsoleWindow GetFileAttributesA GetComputerNameA TerminateProcess Thread32Next Thread32First SuspendThread OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetProcessMemoryInfo QueryFullProcessImageNameA Process32FirstW CloseHandle WideCharToMultiByte OpenThread FindFirstFileA FindNextFileA FindClose GetLogicalDrives GetDriveTypeA DeleteFileA GetDiskFreeSpaceExA WaitForSingleObject CreateThread GetThreadId Sleep ReadFile GetTempPathA GetLastError CreateDirectoryA GetTickCount FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType HeapFree HeapAlloc GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile GetStdHandle LoadLibraryExW FreeLibrary TlsFree FindFirstFileExW FindNextFileW HeapReAlloc SystemTimeToTzSpecificLocalTime IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW RtlUnwind HeapSize WriteConsoleW SetEndOfFile FileTimeToSystemTime TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID SetLastError IsValidLocale QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLocaleInfoW

user32

ShowWindow keybd_event ChangeDisplaySettingsW MessageBoxA EnumDisplaySettingsW FindWindowA SwapMouseButton GetMessageW GetKeyState CallNextHookEx DispatchMessageW UnhookWindowsHookEx TranslateMessage SetWindowsHookExW PostThreadMessageW GetDC EnumDisplayMonitors GetIconInfo GetSystemMetrics GetCursorInfo DrawIconEx ReleaseDC

advapi32

AllocateAndInitializeSid EnumServicesStatusExA CloseServiceHandle QueryServiceConfigA OpenSCManagerA ControlService StartServiceA FreeSid CheckTokenMembership OpenServiceA RegSetValueExA RegEnumValueA RegDeleteValueA RegCloseKey RegQueryValueExA GetUserNameA RegOpenKeyExA

shell32

ShellExecuteExA SHGetFolderPathA ShellExecuteA

ole32

CLSIDFromString CreateStreamOnHGlobal

Name

.text

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3329119906090fa8ad770cdf69e518619a4d8a5f9e6c84234a2a11e538e24e06

ws2_32

gdi32

gdiplus

wininet

kernel32

user32

advapi32

shell32

ole32

generic