b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5

Sharing

Copy URL Twitter E-mail

General

Target
b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5
Size 307KB
Sample260901-2s199sszev
SHA256 b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5
MD5 828717ee374a1b8d5f2fbc518ad55369
SHA1 e6106635ce0ebdb9512f92fb34cc4589bb12b074
SHA512 be371daefc7b625606d17b53e39475cc44f011fc0b4d69ccfca82f9b12291799f01b377ce44438ebef318e7542378fd6112956eb899a177b3d0d428eaef25697
SSDEEP 6144:WFyEnMOELu8dOyYTu3bOQbbbdjtVfhm0ouh:9EnM/Lu8dOyYTU
TLSH
T1116409BADDDA47BBEC91357075A9922A0172FC98B750BF0A9628042F6117F005FDB31E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5

File Explorer

b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5

.exe 307KB

b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5

IMPHASH c237e8efdde9e503b5f2cf120ace438f
SHA256 b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5
MD5 828717ee374a1b8d5f2fbc518ad55369
SHA1 e6106635ce0ebdb9512f92fb34cc4589bb12b074
SHA512 be371daefc7b625606d17b53e39475cc44f011fc0b4d69ccfca82f9b12291799f01b377ce44438ebef318e7542378fd6112956eb899a177b3d0d428eaef25697
SSDEEP 6144:WFyEnMOELu8dOyYTu3bOQbbbdjtVfhm0ouh:9EnM/Lu8dOyYTU
TLSH
T1116409BADDDA47BBEC91357075A9922A0172FC98B750BF0A9628042F6117F005FDB31E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82897

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

vDbgPrintExWithPrefix

comctl32

CreatePropertySheetPageA InitCommonControls PropertySheetA

comdlg32

GetOpenFileNameA PrintDlgW

kernel32

CloseHandle CreateFileA DeleteCriticalSection EnterCriticalSection GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesA GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LocalReAlloc MulDiv OpenFile QueryPerformanceCounter SearchPathA SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery _hread _lclose lstrcmpiA lstrcpynA

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _assert _cexit _errno _fpreset _initterm _iob _lock _onexit _snprintf _stricmp _unlock _vsnprintf abort bsearch calloc exit fprintf free fwrite malloc memcmp memmove realloc signal sprintf strcat strchr strcmp strcpy strcspn strncmp strrchr vfprintf strtol

shell32

ShellAboutW ShellExecuteA

gdi32

BitBlt CloseEnhMetaFile CreateBitmap CreateCompatibleDC CreateDIBitmap CreateEnhMetaFileW CreateFontIndirectW DeleteDC DeleteEnhMetaFile DeleteObject GetEnhMetaFileBits GetTextExtentPointA GetTextMetricsW SelectObject SetBkColor SetTextColor TextOutA

user32

AdjustWindowRect BeginPaint CallWindowProcA CheckMenuItem ClientToScreen CreateIconFromResourceEx CreateWindowExA DefWindowProcA DestroyIcon DestroyMenu DestroyWindow DispatchMessageW EnableWindow EndPaint GetClientRect GetDC GetDlgItem GetMenu GetMessagePos GetMessageW GetParent GetSubMenu GetSystemMetrics GetWindow GetWindowLongA GetWindowLongW GetWindowRect InvalidateRect LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringA LoadStringW MessageBoxA MessageBoxW MoveWindow PostMessageW PostQuitMessage RedrawWindow RegisterClassExA ReleaseDC ScreenToClient SendDlgItemMessageW SendMessageA SendMessageW SetActiveWindow SetCursor SetFocus SetWindowLongA SetWindowLongW SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoW TrackPopupMenu TranslateAcceleratorW TranslateMessage wsprintfA

Name

.text

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b17ff20a8c19566f6b236d6b4e4cefd54478f2b0959aa70d1006ca221a450df5

ntdll

comctl32

comdlg32

kernel32

msvcrt

shell32

gdi32

user32

generic