475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69

General

Target
475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69
Size 2.0MB
Sample260831-fetsdaxtdv
SHA256 475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69
MD5 cfab2c2b99ab4e77f10a53118700f925
SHA1 b8e2aab27508b0c10ee5452db87fbe44dd645765
SHA512 e36b899d2c80a103f9bb0100bcc458f9d5436623ec19a4225c4778e6861de8bf11e876b23ddc020195dc601668ddc5d424597d111213ff6e7e0094693c18edcb
SSDEEP 3072:cCM3B3iQ4p6ZSXEa0mXRdn7gKDu1Y41KECBQY9AooJk:cCMRSRp6ZSUaXXRB7d61HwdQY9ALk
TLSH
T128A55C4BB3A430F9E1778139C8921A41E77278355760ABDF03A0877A2F276D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69

File Explorer

475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69

.exe 2.0MB

475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69

IMPHASH 1117dbeb097f01310598f34a3011fcaa
SHA256 475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69
MD5 cfab2c2b99ab4e77f10a53118700f925
SHA1 b8e2aab27508b0c10ee5452db87fbe44dd645765
SHA512 e36b899d2c80a103f9bb0100bcc458f9d5436623ec19a4225c4778e6861de8bf11e876b23ddc020195dc601668ddc5d424597d111213ff6e7e0094693c18edcb
SSDEEP 3072:cCM3B3iQ4p6ZSXEa0mXRdn7gKDu1Y41KECBQY9AooJk:cCMRSRp6ZSUaXXRB7d61HwdQY9ALk
TLSH
T128A55C4BB3A430F9E1778139C8921A41E77278355760ABDF03A0877A2F276D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\danar\OneDrive\Рабочий стол\Sources\Add\Linkern\x64\Release\Linkern.pdb

kernel32

CloseHandle CreateProcessA WriteConsoleW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive Sleep WaitForSingleObjectEx GetExitCodeThread GetSystemTimeAsFileTime WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo GetStdHandle WriteFile GetModuleFileNameW ExitProcess HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetStringTypeW GetFileType SetFilePointerEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc

urlmon

URLDownloadToFileA

Sharing

General

Malware Config

Signatures

File Explorer

475dde78b758af9a9ae810c128d626c15b88fc21c9db72120f42088ce75e6c69

kernel32

urlmon

generic