cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b

Sharing

Copy URL Twitter E-mail

General

Target
cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b
Size 53KB
Sample260901-2vmjwscl7v
SHA256 cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b
MD5 88ac5d4da705d7908ccbdacd83ff9d02
SHA1 81e5e2961920bf4c613017a4269d12545ab60bb5
SHA512 2b685ccb1a0005d1c26e5739d90196f239bc24a2dfc840f028ca76d4b7f6d784a16371284365fb86211d3e7a8b73144f1ae48b9d4e1f28083c8f104a5c5742fe
SSDEEP 768:NLKSMQO0vmNrMzAx3MvONkp/ZwQQhxt8vGS8fZHSgVLP6M2Oo/ruf:DBNa8vG6TQMAfZHIR/ru
TLSH
T10333D700FFD39DBAEB55413A75B78A8E4773E0588A204BCB924CE1B45D93A3169D338D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b

File Explorer

cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b

.exe 53KB

cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b

IMPHASH 1ea769db6f50821eecc757e111fb4f33
SHA256 cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b
MD5 88ac5d4da705d7908ccbdacd83ff9d02
SHA1 81e5e2961920bf4c613017a4269d12545ab60bb5
SHA512 2b685ccb1a0005d1c26e5739d90196f239bc24a2dfc840f028ca76d4b7f6d784a16371284365fb86211d3e7a8b73144f1ae48b9d4e1f28083c8f104a5c5742fe
SSDEEP 768:NLKSMQO0vmNrMzAx3MvONkp/ZwQQhxt8vGS8fZHSgVLP6M2Oo/ruf:DBNa8vG6TQMAfZHIR/ru
TLSH
T10333D700FFD39DBAEB55413A75B78A8E4773E0588A204BCB924CE1B45D93A3169D338D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

vDbgPrintExWithPrefix

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WriteConsoleW WriteFile

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snprintf _snwprintf _unlock _vsnprintf _vsnwprintf _wcmdln _wcsicmp abort bsearch calloc exit free fwrite malloc memcmp memmove signal sprintf strchr strcmp strcpy strcspn strncmp vfprintf wcscat wcscpy wcslen

ole32

CoCreateInstance CoInitialize CoInitializeSecurity CoUninitialize

oleaut32

SafeArrayDestroy SafeArrayGetElement SafeArrayGetUBound SysAllocString SysAllocStringLen SysFreeString VariantChangeType VariantClear

user32

LoadStringW

Name

.text

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cb7aa7db5b5b481c0dd4bca5f356f93288aa1e294292ccec84c21123605b9a8b

ntdll

kernel32

msvcrt

ole32

oleaut32

user32

generic