38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e

Sharing

Copy URL Twitter E-mail

General

Target
38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e
Size 101KB
Sample260901-2vmjwscl7s
SHA256 38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e
MD5 9e5a6b7ca9c5f5634e6061a28f8cffba
SHA1 b96ffa3359747f80b68e293b8689822700891bc1
SHA512 a9fee6660a0cd3ae89f0ddcb88bd083c12ce5b3c26ea9d16d7c4ed4c2b3f66cd309b4437b5917f09dc4af2eefe2a035915ef3566164e772961c2912812da49e7
SSDEEP 3072:JvlN5K9njb3qQij/pLvgJHSRNloT2CEF3ddN3h+EYkMAIr4elDvnI0ZDVVkEyXX:JtN5KRbU5KSRNloT2CEF3ddN3h+EYkM
TLSH
T1CEA39202FFEF461AF9B326781DB78485463AF94FAA31810F4364546D19B171086FAB3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e

File Explorer

38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e

.exe 101KB

38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e

IMPHASH a9ce197d7a91e0e361c44945c8bbf8a8
SHA256 38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e
MD5 9e5a6b7ca9c5f5634e6061a28f8cffba
SHA1 b96ffa3359747f80b68e293b8689822700891bc1
SHA512 a9fee6660a0cd3ae89f0ddcb88bd083c12ce5b3c26ea9d16d7c4ed4c2b3f66cd309b4437b5917f09dc4af2eefe2a035915ef3566164e772961c2912812da49e7
SSDEEP 3072:JvlN5K9njb3qQij/pLvgJHSRNloT2CEF3ddN3h+EYkMAIr4elDvnI0ZDVVkEyXX:JtN5KRbU5KSRNloT2CEF3ddN3h+EYkM
TLSH
T1CEA39202FFEF461AF9B326781DB78485463AF94FAA31810F4364546D19B171086FAB3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation LookupAccountSidW LookupPrivilegeDisplayNameW LookupPrivilegeNameW OpenProcessToken

kernel32

CloseHandle DeleteCriticalSection EnterCriticalSection FillConsoleOutputCharacterW FindResourceExW FlushFileBuffers FormatMessageW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileType GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LCMapStringW LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource QueryPerformanceCounter RtlUnwind SetConsoleCursorPosition SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snwprintf _unlock _vsnwprintf _wcmdln _wcsicmp abort calloc exit free fwrite malloc memmove signal strncmp vfprintf wcscpy wcslen

secur32

GetUserNameExW

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

38cf994bd21500ac54d445a91ab752498528be782984e5ccab29fd34ac59142e

advapi32

kernel32

msvcrt

secur32

generic