573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043

Sharing

Copy URL Twitter E-mail

General

Target
573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043
Size 158KB
Sample260901-2vakbsfb55
SHA256 573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043
MD5 1ca1649eacffe072f8eb98d4daad676b
SHA1 012d7d1b4bf8ba4dafe200f74711dc930de613ea
SHA512 13433a9385db4f966f863ce6302a0720022d93d1f738b0c9c67a8ee0e60363c56fd786fc8342a1f7262f7687a3a59ce765c27fdfb0d8589f16997e2a4b421a8d
SSDEEP 1536:ADHaXm0Ys1g3GSlW7g6g4SI43o4MrLCu4VFPMpSNSuz0uIEPXuVok5+ylnZ9yU8i:ADa20YJ07Vg4p44XLCuIPz0yrNcp
TLSH
T137F31B0667F95549FAF33B7898B502956B3BFD61A938C40F03A9401DDBB2A60DE60363
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043

File Explorer

573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043

.exe 158KB

573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043

IMPHASH a9d7b2714c8ab230dc1557ed8b86a5b2
SHA256 573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043
MD5 1ca1649eacffe072f8eb98d4daad676b
SHA1 012d7d1b4bf8ba4dafe200f74711dc930de613ea
SHA512 13433a9385db4f966f863ce6302a0720022d93d1f738b0c9c67a8ee0e60363c56fd786fc8342a1f7262f7687a3a59ce765c27fdfb0d8589f16997e2a4b421a8d
SSDEEP 1536:ADHaXm0Ys1g3GSlW7g6g4SI43o4MrLCu4VFPMpSNSuz0uIEPXuVok5+ylnZ9yU8i:ADa20YJ07Vg4p44XLCuIPz0yrNcp
TLSH
T137F31B0667F95549FAF33B7898B502956B3BFD61A938C40F03A9401DDBB2A60DE60363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

vDbgPrintExWithPrefix

kernel32

CloseHandle CompareFileTime CompareStringW CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FormatMessageW GetCommandLineW GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesW GetFileTime GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount GetTimeFormatW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc QueryPerformanceCounter ReadFile SetFileAttributesW SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile lstrcatW lstrcmpW lstrcpyW lstrlenW

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _wcmdln _wcsdup _wfopen _wsplitpath _wtol abort bsearch calloc exit fclose feof fgetws free fwrite malloc memcmp memmove signal sprintf strchr strcmp strcpy strcspn strncmp toupper vfprintf wcschr wcscpy wcsrchr wcsstr

user32

CharUpperBuffW LoadStringW

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

573a02588772bdd5174f9b955d7d25d29b85cca885017ef9f53367cc495be043

ntdll

kernel32

msvcrt

user32

generic