7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b

Sharing

Copy URL Twitter E-mail

General

Target
7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b
Size 6.5MB
Sample260831-l81exafg86
SHA256 7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b
MD5 7e2080c38aa0950a18f114d0bf07d7cc
SHA1 40fdc07c516ff596c1126740af9d0db8f34ba4f0
SHA512 6d0186da7b4ed369b3d60288c13b6287c183598ad649314a27adae9ebff18c781cb02814c86e6d46f67c28d5585ce748c5505037066fb8b0a5b19e6263886c8f
SSDEEP 98304:M3nTfJTl6TC8e8+pDnapSKd0GATWKN4GxW0A+XDWy+JplUJfUcOP:MjhTlz8e86napSgKtN4GtAoZJMcOP
TLSH
T1F666E06A62F400F9C1ABC2789986570FF6707817D7306BEF07E20E561F57AE10A7E681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b

File Explorer

7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b

.exe 6.5MB

7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b

IMPHASH 3c349cf8dc08d21e2b7187f46d3c04b6
SHA256 7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b
MD5 7e2080c38aa0950a18f114d0bf07d7cc
SHA1 40fdc07c516ff596c1126740af9d0db8f34ba4f0
SHA512 6d0186da7b4ed369b3d60288c13b6287c183598ad649314a27adae9ebff18c781cb02814c86e6d46f67c28d5585ce748c5505037066fb8b0a5b19e6263886c8f
SSDEEP 98304:M3nTfJTl6TC8e8+pDnapSKd0GATWKN4GxW0A+XDWy+JplUJfUcOP:MjhTlz8e86napSgKtN4GtAoZJMcOP
TLSH
T1F666E06A62F400F9C1ABC2789986570FF6707817D7306BEF07E20E561F57AE10A7E681
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1455612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW FreeLibrary SetFilePointer LocalFileTimeToFileTime GetLastError GetCurrentDirectoryW WideCharToMultiByte LocalAlloc UnmapViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile HeapFree SetPriorityClass GetCurrentProcess VirtualAlloc SetThreadPriority InitializeCriticalSectionEx GetEnvironmentVariableA GetModuleHandleA GetExitCodeThread GetTickCount64 Process32NextW GlobalSize GetCurrentThread GetSystemDirectoryA K32GetModuleBaseNameA RaiseException HeapAlloc DecodePointer GlobalLock DeleteCriticalSection ExitProcess GetCurrentProcessId GetProcessHeap GetModuleHandleW K32EnumProcessModules VerifyVersionInfoW GlobalUnlock VirtualQuery GetComputerNameA GetCurrentThreadId GetFullPathNameA SetEnvironmentVariableA CreateMutexA SizeofResource GetFileSizeEx CreateFile2 FreeResource HeapSize Sleep GetTempPathA LockResource HeapReAlloc CreateThread LoadResource FindResourceW CreateFileMappingFromApp MapViewOfFileFromApp GetModuleFileNameA SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryW QueryPerformanceCounter GetTickCount MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType ReadFile WaitForMultipleObjects FindClose FindNextFileW TryEnterCriticalSection InitializeSRWLock GetNativeSystemInfo VerSetConditionMask GetWindowsDirectoryA CloseHandle MultiByteToWideChar WaitForSingleObject GetVolumeInformationA PeekNamedPipe GetStartupInfoW GetSystemFirmwareTable GetProcAddress LoadLibraryA WriteConsoleW InitOnceBeginInitialize RtlUnwind InitOnceComplete SleepConditionVariableSRW DeleteFileW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetStringTypeW AcquireSRWLockShared AcquireSRWLockExclusive FindFirstFileExW SetEndOfFile GetFullPathNameW GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleFileNameW GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode CreateDirectoryW ReleaseSRWLockShared SetEnvironmentVariableW SetFilePointerEx GetFileAttributesExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW FreeLibraryAndExitThread ExitThread SetStdHandle GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx OutputDebugStringW GetCPInfo CompareStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

user32

MessageBoxA

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW OpenProcessToken SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor

shell32

SHGetFolderPathA

ole32

CoInitializeSecurity CoSetProxyBlanket CreateStreamOnHGlobal CoCreateInstance CoUninitialize GetHGlobalFromStream CoInitializeEx

oleaut32

SafeArrayCreate VariantClear SysAllocString SafeArrayPutElement VariantInit SysFreeString

shlwapi

PathRemoveFileSpecA

ws2_32

getnameinfo setsockopt WSACleanup bind closesocket getaddrinfo WSAStartup getsockname socket ntohs gethostname htonl inet_ntop freeaddrinfo htons recv ioctlsocket sendto recvfrom accept __WSAFDIsSet WSAIoctl WSASetLastError WSACloseEvent getsockopt connect WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent select shutdown listen WSAAccept WSASocketW getpeername send

wldap32

ord301 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord145

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

339KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fOO

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7e86333d274ddc6ae2631fff59faf08eaf66f77a965f8fea397eeca7957a226b

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wldap32

gdiplus

ntdll

generic