1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e

Sharing

Copy URL Twitter E-mail

General

Target
1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e
Size 618KB
Sample260901-2vbgmacl5w
SHA256 1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e
MD5 7be0968d57ba0580b4745d6600af853d
SHA1 e145d8ef90942d2e2344360cef7fa0402c756fe4
SHA512 4b525bf26348fbb137662dbda9342ca0c37f235cf7c9561685a9dddc3a4c7e01a6c09603b3f1e80b6fbff6774bfdfff614c4caadc769ca4b3a4928d9de40a47d
SSDEEP 12288:5PRtu0dFv9VYciZ6YaWd7tMlM9HclbCuQ:fXD1iZ6YL7toMxcm
TLSH
T1CBD45E11E9C688F3DB9A09714963A20F46BBEA00E753EFD77F0964B86A617112F1D31C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e

File Explorer

1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e

.dll 618KB

1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e

IMPHASH 4e4e9d527e4521493a74044092530c36
SHA256 1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e
MD5 7be0968d57ba0580b4745d6600af853d
SHA1 e145d8ef90942d2e2344360cef7fa0402c756fe4
SHA512 4b525bf26348fbb137662dbda9342ca0c37f235cf7c9561685a9dddc3a4c7e01a6c09603b3f1e80b6fbff6774bfdfff614c4caadc769ca4b3a4928d9de40a47d
SSDEEP 12288:5PRtu0dFv9VYciZ6YaWd7tMlM9HclbCuQ:fXD1iZ6YL7toMxcm
TLSH
T1CBD45E11E9C688F3DB9A09714963A20F46BBEA00E753EFD77F0964B86A617112F1D31C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint NlsMbCodePageTag NtClearEvent NtClose NtCreateEvent NtCreateMutant NtCreateSection NtDuplicateObject NtMapViewOfSection NtOpenKey NtOpenProcess NtQueryDefaultLocale NtQueryInformationProcess NtQueryValueKey NtReadVirtualMemory NtReleaseMutant NtResumeThread NtSetEvent NtTerminateProcess NtUnmapViewOfSection NtWaitForSingleObject RtlAcquireResourceExclusive RtlAcquireResourceShared RtlAllocateHeap RtlAnsiCharToUnicodeChar RtlAnsiStringToUnicodeString RtlAppendUnicodeToString RtlAreBitsClear RtlAreBitsSet RtlAssert RtlCompareUnicodeString RtlCopyUnicodeString RtlCreateUserThread RtlDeleteCriticalSection RtlDosSearchPath_U RtlDuplicateUnicodeString RtlEnterCriticalSection RtlEqualUnicodeString RtlExitUserThread RtlFindMessage RtlFreeHeap RtlFreeUnicodeString RtlGetLastNtStatus RtlInitAnsiString RtlInitUnicodeString RtlInitializeBitMap RtlInitializeCriticalSection RtlInitializeResource RtlLeaveCriticalSection RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlNtStatusToDosError RtlOpenCurrentUser RtlPrefixUnicodeString RtlReleaseResource RtlSetBits RtlUnicodeStringToAnsiString RtlUnicodeStringToInteger RtlxUnicodeStringToAnsiSize

kernel32

Beep CloseHandle CreateRemoteThread CreateThread DeleteCriticalSection EnterCriticalSection GetACP GetExitCodeThread GetLastError GetModuleHandleW GetOEMCP GetProcAddress GetSystemWindowsDirectoryW GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsValidCodePage LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar RaiseException RtlUnwind SetLastError TerminateThread WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte

csrsrv

CsrAddStaticServerThread CsrConnectToUser CsrCreateWait CsrDereferenceProcess CsrDereferenceThread CsrDereferenceWait CsrExecServerThread CsrGetProcessLuid CsrImpersonateClient CsrLockProcessByClientId CsrLockThreadByClientId CsrNotifyWait CsrQueryApiPort CsrReferenceThread CsrRevertToSelf CsrSetBackgroundPriority CsrSetForegroundPriority CsrShutdownProcesses CsrUnlockProcess CsrUnlockThread CsrValidateMessageBuffer

basesrv

BaseSetProcessCreateNotify

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgnIndirect CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExW GetCurrentObject GetDeviceCaps GetObjectW GetPaletteEntries GetTextMetricsW InvertRgn PatBlt RealizePalette SelectObject SelectPalette SetBkColor SetDIBitsToDevice SetSystemPaletteUse SetTextColor TextOutW TranslateCharsetInfo

user32

AppendMenuW BeginPaint ChangeDisplaySettingsW CloseClipboard CloseDesktop CloseWindowStation CopyIcon CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawMenuBar EmptyClipboard EnableMenuItem EndPaint EnumThreadWindows GetClipboardData GetCursorPos GetDC GetDlgItem GetKeyState GetKeyboardLayoutNameA GetKeyboardLayoutNameW GetKeyboardState GetMenuItemInfoW GetMessageW GetMonitorInfoW GetScrollInfo GetSystemMenu GetSystemMetrics GetTaskmanWindow GetUserObjectInformationW GetWindow GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect InvalidateRgn IsClipboardFormatAvailable IsDialogMessageW IsIconic IsWindow IsZoomed KillTimer LoadCursorW LoadImageW LoadStringW MapVirtualKeyW MessageBoxTimeoutW MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW PrivateExtractIconsW RegisterClassExW RegisterWindowMessageW ReleaseCapture ReleaseDC ScrollWindowEx SendMessageTimeoutW SendMessageW SendNotifyMessageW SetCapture SetClipboardData SetCursor SetForegroundWindow SetMenuItemInfoW SetScrollInfo SetThreadDesktop SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowScrollBar ShowWindow ShowWindowAsync ToUnicodeEx TrackPopupMenuEx TranslateMessage UnregisterClassW UpdateWindow VkKeyScanW WindowFromPoint

Name

.text

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

322KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1a181d2560395bce0ed8af61797ab6408bdf35efe67c1e815c642324db61145e

ntdll

kernel32

csrsrv

basesrv

gdi32

user32

generic