c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9

Sharing

Copy URL Twitter E-mail

General

Target
c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9
Size 65KB
Sample260901-2xextsyeng
SHA256 c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9
MD5 f937cd5681abae9f405f31fff720a2ba
SHA1 fd43fbed29aea390d4b9b6d24cad02e1bb0b1459
SHA512 caa0729f1d5563d1a40f29ab6cea0c68bf2197e4b75c7470796cc50c743cf67ecc94caa886048ba8cf5605f6b282e15cd265526413dd5ffe080d3ce42841ce01
SSDEEP 768:yWJowbyBZaRJMoQZBHn3BHqCBHscBHywBHqWBBKjBHv/BFnhBHGTBHZ1Bf3lBHag:pJDbuqyMCRiBVWDG
TLSH
T1CB631906C7D90467E9F2B73006BE9B780175FD084F218E1FB115816A3BB0BA4DF69B1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9

File Explorer

c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9

.dll 65KB

c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9

IMPHASH bd6b6f6294a3b7eb15c4acea83406645
SHA256 c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9
MD5 f937cd5681abae9f405f31fff720a2ba
SHA1 fd43fbed29aea390d4b9b6d24cad02e1bb0b1459
SHA512 caa0729f1d5563d1a40f29ab6cea0c68bf2197e4b75c7470796cc50c743cf67ecc94caa886048ba8cf5605f6b282e15cd265526413dd5ffe080d3ce42841ce01
SSDEEP 768:yWJowbyBZaRJMoQZBHn3BHqCBHscBHywBHqWBBKjBHv/BFnhBHGTBHZ1Bf3lBHag:pJDbuqyMCRiBVWDG
TLSH
T1CB631906C7D90467E9F2B73006BE9B780175FD084F218E1FB115816A3BB0BA4DF69B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10336

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint

advapi32

CreateProcessAsUserW DuplicateTokenEx OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControlsEx

kernel32

CloseHandle CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameW GetModuleHandleA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryW OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock _vsnwprintf _wcsicmp abort calloc free fwrite memmove strncmp vfprintf

shell32

ExtractIconW ShellAboutW

user32

AppendMenuW DestroyIcon DialogBoxParamW EnableWindow EndDialog GetDesktopWindow GetDlgItem GetSystemMenu GetSystemMetrics GetWindowRect KillTimer LoadStringW SendMessageW SetTimer SetWindowPos SetWindowTextW

Name

.text

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c07ead11c7d6f51ca90a9a30b0f4b31c3decda34f7076f922193a391db196fa9

ntdll

advapi32

comctl32

kernel32

msvcrt

shell32

user32

generic