46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe

Sharing

Copy URL Twitter E-mail

General

Target
46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe
Size 215KB
Sample260901-mk2thaxble
SHA256 46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe
MD5 ef9113d7e5ab0ddceb3c7fb643624592
SHA1 2a7d2e5901adf6ac2c1e51ebaad59851810a6348
SHA512 e77c4bb06a28d3ae58019b3817d9018c187df5bef3de6f3dbb20ea2f553701d54fbaad237b51d9270de83a8e3f8eafcc8b066ce80197f6e1273713f25b5aa413
SSDEEP 3072:QoAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:Q7vJN/CE/TZINiPPBIwcuWTegi9W
TLSH
T1FD24123BF6A418C3E6B63A3014FEF15819A8952C3552AE3BB40613DD2F662C44FF5B58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe

File Explorer

46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe

.exe 215KB

46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe

IMPHASH a0f41bd5de82cbb844f692b48ffd09bd
SHA256 46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe
MD5 ef9113d7e5ab0ddceb3c7fb643624592
SHA1 2a7d2e5901adf6ac2c1e51ebaad59851810a6348
SHA512 e77c4bb06a28d3ae58019b3817d9018c187df5bef3de6f3dbb20ea2f553701d54fbaad237b51d9270de83a8e3f8eafcc8b066ce80197f6e1273713f25b5aa413
SSDEEP 3072:QoAbvJrZ/CEp1Td3INNAILgwKRpP3fJ2pwLAt/iw1JmWTe1eyfLUH+xW6Lyk:Q7vJN/CE/TZINiPPBIwcuWTegi9W
TLSH
T1FD24123BF6A418C3E6B63A3014FEF15819A8952C3552AE3BB40613DD2F662C44FF5B58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AddAtomA GetFileTime GetPriorityClass OpenMutexW lstrcatA GetShortPathNameW GlobalFindAtomW GetWindowsDirectoryW GetProcAddress GetDateFormatW CreateMutexA GetModuleHandleA CopyFileA lstrcmpW CreateFileMappingW FindAtomW GetLastError GetExpandedNameA OpenEventA GetUserDefaultLangID CreateFileMappingA CreateDirectoryA ReadDirectoryChangesW GetCurrentDirectoryA lstrcmpA FatalAppExitW SetEvent GetEnvironmentStringsW GetExpandedNameW lstrlenA GetNumberFormatW GetFileType EnumDateFormatsW DosDateTimeToFileTime GetStringTypeA lstrcmpW IsBadReadPtr EndUpdateResourceA TlsAlloc OpenSemaphoreW GetStartupInfoW GetCurrentProcess GetFullPathNameA GetTickCount GetHandleInformation GetCurrentThread GetTempPathW OpenEventW GetFullPathNameW EnumTimeFormatsW GetVolumeInformationW FatalAppExitA lstrcpyA lstrlenW CreateNamedPipeW lstrcmp FileTimeToSystemTime GetAtomNameW DisconnectNamedPipe

user32

CharNextW EnumDesktopsW MessageBeep DialogBoxParamA GetClassNameW CallWindowProcA InsertMenuItemA SetCursor FlashWindow WaitForInputIdle EnumDesktopsA RegisterClassExW ChildWindowFromPoint LoadBitmapW CharLowerA GetForegroundWindow DrawTextW UnregisterClassA CopyImage CreateDialogParamA GetDlgItemInt CopyRect SetWindowLongW DefDlgProcW SetWindowTextW EnableMenuItem CreateDialogParamW GetScrollPos GetSysColor GetMenuItemInfoA RegisterClassA LoadImageW DialogBoxParamW DefWindowProcA GetClassInfoW PeekMessageW GetDC DefFrameProcW GetClassInfoExW wvsprintfA GetWindowTextLengthA DeleteMenu CopyIcon SetCursorPos SendMessageW FindWindowW CreatePopupMenu ActivateKeyboardLayout LoadCursorW IsIconic wvsprintfW MessageBoxA GetSubMenu SetDlgItemTextA IsWindow

gdi32

SelectClipPath SetROP2 SetDIBits CreateFontW GetFontData GetDeviceCaps GetArcDirection GetGraphicsMode CloseMetaFile SetViewportOrgEx EnumFontFamiliesW EnumFontFamiliesExW ExtEscape CreateSolidBrush GetClipRgn GetPaletteEntries CreateMetaFileA GetEnhMetaFileHeader RemoveFontResourceW GetICMProfileW GetCharABCWidthsFloatA

advapi32

RegSetValueA RegEnumValueW RegEnumKeyW RegFlushKey RegDeleteKeyW RegRestoreKeyW RegDeleteValueA RegQueryInfoKeyA

shell32

StrNCmpIA StrCmpNIW ShellExecuteW SHBrowseForFolderW

comdlg32

PrintDlgA GetFileTitleW PrintDlgExA PageSetupDlgW ReplaceTextA ReplaceTextW GetSaveFileNameW ChooseFontA PrintDlgExW PageSetupDlgA LoadAlterBitmap

ole32

CoGetClassObject GetClassFile CoGetInstanceFromIStorage BindMoniker CoGetDefaultContext OleUninitialize CoCreateInstance CoGetMalloc

ws2_32

WSADuplicateSocketW send getservbyport WSADuplicateSocketA accept gethostname

winmm

mixerClose midiInAddBuffer PlaySound midiInPrepareHeader midiInGetID mmioAscend waveInGetNumDevs mmioClose

winspool.drv

EnumPrintProcessorsW EnumPrintersA StartDocDlgA EnumPrintProcessorsA ConvertAnsiDevModeToUnicodeDevmode StartPagePrinter GetPrintProcessorDirectoryW AddPrinterW SetPrinterDataA

inetcomm

EssReceiptRequestDecodeEx MimeOleParseMhtmlUrl EssSecurityLabelEncodeEx MimeOleGetCodePageInfo MimeOleSMimeCapAddSMimeCap MimeOleOpenFileStream MimeOleSMimeCapGetEncAlg MimeEditDocumentFromStream

oledlg

OleUIObjectPropertiesA OleUIEditLinksW OleUIInsertObjectA OleUIPasteSpecialA OleUIChangeSourceA OleUIBusyW OleUIChangeIconW OleUIInsertObjectW

wsock32

WSAStartup GetNameByTypeW WSASetBlockingHook EnumProtocolsA htons WSAStartup select send

Name

.rdata

Size

1KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

7KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

1024B

Virtual Size

22KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.edata

Size

1KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

1KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

1KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

46f9e4f78bd3ec9317ed625b289d9ee148fd3440dbc1a55a8a76c50ed0ab08fe

kernel32

user32

gdi32

advapi32

shell32

comdlg32

ole32

ws2_32

winmm

winspool.drv

inetcomm

oledlg

wsock32

generic