6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a

Sharing

Copy URL Twitter E-mail

General

Target
6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a
Size 2.4MB
Sample260903-rc2wraydke
SHA256 6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a
MD5 8954095b6008b3daea4df297db732aa6
SHA1 4816082774c006ddd497f17dcde2b31f03a528bc
SHA512 db55865bbd84746726cd975b25cc1651882ee6daa4ffeea91ebd35e13292f6ad5201adca84f6dd4b455d62cb5b59e400496e206ebc640a49c46a94e0b7fe3aff
SSDEEP 24576:y+OJHHSM4eHY4BJH1fAjIp5SM4VHGM6gjEZwRuCxwwcaHfAjIp2Hbo:DgHHlhXLH1fAjIvlCmMB7F7xfAjIsHE
TLSH
T174C57D09A7E05662E6AD1B3165BD932E07743A02AB7CCEDFC198146C5F72BC42E73712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a

File Explorer

6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a

.dll 2.4MB

6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a

IMPHASH eca8ab7d26a85ff31e195955752caef4
SHA256 6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a
MD5 8954095b6008b3daea4df297db732aa6
SHA1 4816082774c006ddd497f17dcde2b31f03a528bc
SHA512 db55865bbd84746726cd975b25cc1651882ee6daa4ffeea91ebd35e13292f6ad5201adca84f6dd4b455d62cb5b59e400496e206ebc640a49c46a94e0b7fe3aff
SSDEEP 24576:y+OJHHSM4eHY4BJH1fAjIp5SM4VHGM6gjEZwRuCxwwcaHfAjIp2Hbo:DgHHlhXLH1fAjIvlCmMB7F7xfAjIsHE
TLSH
T174C57D09A7E05662E6AD1B3165BD932E07743A02AB7CCEDFC198146C5F72BC42E73712
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

391264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

LoadRegTypeLib SafeArrayAccessData SafeArrayCopy SafeArrayDestroy SafeArrayGetDim SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen VarUdateFromDate VariantChangeTypeEx VariantClear VariantCopy VariantInit

ole32

CLSIDFromProgID CoGetClassObject CoTaskMemFree

user32

LoadStringW

advapi32

SystemFunction036

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswprintf_s _assert _create_locale _dclass _free_locale _itow_s _ltow_s _strdup _wcsdup _wcsicmp _wcsnicmp acos asin atan atan2 bsearch calloc ceil cos exp floor fmod free fwrite getenv isalnum iswalnum iswalpha iswspace log log10 lround malloc memcmp memcpy memmove memset pow realloc sin sqrt strchr strcmp strcpy strcspn strlen tan towlower towupper wcschr wcscmp wcscpy wcslen wcsncmp wcsstr wcstol

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FileTimeToLocalFileTime FindResourceW GetDateFormatW GetEnvironmentVariableW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetNumberFormatW GetProcAddress GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue TzSpecificLocalTimeToSystemTime WideCharToMultiByte

ntdll

_aulldiv _vsnprintf

Name

.text

Size

380KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

4KB

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

172KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

796KB

Virtual Size

794KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

280KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

40KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

304KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6fe82f48dd32ecdf8c1c0e19fd8fb6837e0861ad00dccff1c62603a2034c5c7a

oleaut32

ole32

user32

advapi32

ucrtbase

kernel32

ntdll

generic