366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a

Sharing

Copy URL Twitter E-mail

General

Target
366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a
Size 4.8MB
Sample260831-rlht8sbm6v
SHA256 366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a
MD5 29e2e6b838ea4ced78a1b9115e7a227b
SHA1 10b4968d1afaef1c77bb6dec6e9f0f085edb068e
SHA512 1d1ad7e731ed638991d4a72f901f8028c86d5b9c63a5f517a250347eb50330184a25beafc552cf26c28251aaea4b1a95b20640f43758c27872c3f95220e0f61d
SSDEEP 49152:0VzjQqBP8SYdZqZSFNSimNntHZKNiRA55e94tjRYpbNY1vYNPmzISs/1j2lH1DuF:YeOKNiRA55e94kphY1vc6IZ/4MNNKE
TLSH
T13E36124766F80795E4B5A7799970B08182F27A968C32C2AF6B84CC5E5F53B448F34F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a

File Explorer

366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a

.exe 4.8MB

366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a

IMPHASH 6c14914f239ea9133a9f6bb9ea4d066c
SHA256 366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a
MD5 29e2e6b838ea4ced78a1b9115e7a227b
SHA1 10b4968d1afaef1c77bb6dec6e9f0f085edb068e
SHA512 1d1ad7e731ed638991d4a72f901f8028c86d5b9c63a5f517a250347eb50330184a25beafc552cf26c28251aaea4b1a95b20640f43758c27872c3f95220e0f61d
SSDEEP 49152:0VzjQqBP8SYdZqZSFNSimNntHZKNiRA55e94tjRYpbNY1vYNPmzISs/1j2lH1DuF:YeOKNiRA55e94kphY1vc6IZ/4MNNKE
TLSH
T13E36124766F80795E4B5A7799970B08182F27A968C32C2AF6B84CC5E5F53B448F34F0E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW SetFilePointer WriteFile GetTempPathW GetFileAttributesW GetModuleFileNameW GetCurrentDirectoryW FindResourceW LoadResource LockResource SizeofResource LocalFree VerifyVersionInfoW VerSetConditionMask FreeLibrary SetErrorMode FormatMessageW WriteConsoleW FlushConsoleInputBuffer WaitForSingleObject PeekConsoleInputW ReadConsoleInputW GetStdHandle GetConsoleMode QueryPerformanceFrequency QueryPerformanceCounter GetCurrentThreadId CreateThread InitializeCriticalSectionAndSpinCount RaiseException CreateProcessW DeleteCriticalSection GetConsoleOutputCP FlushFileBuffers SetFilePointerEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapSize GetProcessHeap GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetModuleHandleExW GetCurrentProcess TerminateProcess Module32NextW Module32FirstW CreateToolhelp32Snapshot CloseHandle SetDllDirectoryW SetSearchPathMode LoadLibraryW GetSystemDirectoryW LoadLibraryExW GetProcAddress GetModuleHandleW CompareStringW DecodePointer GetLastError ExitProcess HeapFree HeapReAlloc HeapAlloc GetCommandLineW GetCommandLineA RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW IsDebuggerPresent GetCPInfo GetLocaleInfoW LCMapStringW LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc Sleep SetLastError EncodePointer GetStringTypeW WideCharToMultiByte MultiByteToWideChar

user32

GetCursorInfo MonitorFromPoint GetMonitorInfoW GetSystemMetrics PostThreadMessageW IsWindow TranslateMessage DispatchMessageW SetTimer LoadCursorW GetProcessWindowStation MessageBoxW GetMessageW LoadIconW DestroyWindow GetGUIThreadInfo KillTimer DefWindowProcW GetWindowLongPtrW SetWindowLongPtrW GetAncestor IsWindowVisible EnumThreadWindows SetWindowPos UpdateLayeredWindow CreateWindowExW RegisterClassExW GetUserObjectInformationW

gdi32

CreateCompatibleDC DeleteObject CreateDIBSection DeleteDC GetDeviceCaps CreateDCW SelectObject

advapi32

RegCreateKeyExW RegGetValueW RegQueryValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegSetValueExW

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysAllocStringByteLen SysAllocString SysFreeString SysStringLen VariantChangeType VariantClear VariantInit SysStringByteLen SafeArrayGetUBound SafeArrayGetLBound VariantCopyInd CreateErrorInfo GetErrorInfo SafeArrayRedim SafeArrayUnlock SafeArrayCopy SafeArrayLock SafeArrayCreate SafeArrayDestroy SafeArrayGetVartype SetErrorInfo

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateFromHDC GdipCreateHatchBrush GdipCreateSolidFill GdipFree GdipAlloc GdipDeleteBrush GdipFillRectangleI GdipDeleteGraphics GdipCloneBrush

Name

.text

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

366b57f1c7cfec4b28fdb5521c67e38142488dc148d81092785cabf682c52e0a

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

generic