85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12

Sharing

Copy URL Twitter E-mail

General

Target
85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12
Size 673KB
Sample260831-ff89fsxvcs
SHA256 85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12
MD5 25ca18815ea8c40e69f4f63844398667
SHA1 4dd987b5b2eec686d3c7f0fdcb1dd6d5b6ac091e
SHA512 b10d29b9cebf2f07ac4044ba63be5b9663d0c52f5f8b9a98e230f5dd211d0683617addd22fddcf6d9e374ad1da24029fe9e9b63dad84603348fb1cc92f4f19f7
SSDEEP 6144:P2XnvLyFGAayysdehwF7N0tiTsNyR/mD:P2XvLqay5ehW7PsUR/
TLSH
T1B1E4FC03F9EFD0D4C95D843AFF6371E0A2A578FE0255465B72C06B9AFB22250E51F12A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12

File Explorer

85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12

.exe 673KB

85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12

IMPHASH 0901ccdfe441170225445647a9ca8d20
SHA256 85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12
MD5 25ca18815ea8c40e69f4f63844398667
SHA1 4dd987b5b2eec686d3c7f0fdcb1dd6d5b6ac091e
SHA512 b10d29b9cebf2f07ac4044ba63be5b9663d0c52f5f8b9a98e230f5dd211d0683617addd22fddcf6d9e374ad1da24029fe9e9b63dad84603348fb1cc92f4f19f7
SSDEEP 6144:P2XnvLyFGAayysdehwF7N0tiTsNyR/mD:P2XvLqay5ehW7PsUR/
TLSH
T1B1E4FC03F9EFD0D4C95D843AFF6371E0A2A578FE0255465B72C06B9AFB22250E51F12A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bintsiurn.pdb

kernel32

WaitForSingleObject ExitProcess GetConsoleMode MultiByteToWideChar GetStdHandle SetLastError GetModuleHandleA GetLastError GetConsoleOutputCP GetProcAddress LoadLibraryA GetCurrentThread FindVolumeMountPointClose GetFileAttributesW GenerateConsoleCtrlEvent SetThreadStackGuarantee GetVolumeNameForVolumeMountPointW WriteConsoleW IsValidLocaleName QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime RtlLookupFunctionEntry IsDebuggerPresent IsDBCSLeadByteEx IsProcessorFeaturePresent GetModuleHandleW TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW FlushFileBuffers SetFilePointerEx CreateFileW CloseHandle GetSystemDefaultLCID GetStartupInfoW VerLanguageNameW RtlVirtualUnwind InitializeSListHead RtlCaptureContext UnhandledExceptionFilter HeapAlloc AddVectoredExceptionHandler HeapReAlloc HeapSize HeapFree GetProcessHeap VirtualProtect InitializeCriticalSectionEx WriteFile SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount RtlUnwindEx DeleteCriticalSection EnterCriticalSection LeaveCriticalSection

shlwapi

PathCommonPrefixA PathAddExtensionW SHUnicodeToAnsi PathBuildRootA

dbghelp

SymGetHomeDirectory SearchTreeForFile SymRefreshModuleList

user32

FindWindowA GetShellWindow GetKeyNameTextW

ntdll

RtlNtStatusToDosError NtWriteFile RtlGetVersion

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

Sharing

General

Malware Config

Signatures

File Explorer

85881a6d2f7c7ee4a716b110b7253578db837f6bd806c86e57290c39d9d00e12

kernel32

shlwapi

dbghelp

user32

ntdll

api-ms-win-core-synch-l1-2-0

generic