878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d

Sharing

Copy URL Twitter E-mail

General

Target
878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d
Size 268KB
Sample260903-rc4eksydkf
SHA256 878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d
MD5 a3857af0103e6a5d79c69ab60751c763
SHA1 bed9065a81aadb31bd34d74f73eb27ae41d8328d
SHA512 ef6c6ae58df670e95c913723632758c11ed69400c647cd839532cfd4a0c4f4fd87e76fedee7db680771b9a43e653bd9ac1c9e6b99499559a26649aaa135441c4
SSDEEP 3072:VfamN+sbPbUfebSM0D7O7qFcSsenSV9FPX:JU8SspVrX
TLSH
T17A44D20273A59822D9664F36887B438AAB36FC552F26D7CF0A5870FC1C727C21D78B59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d

File Explorer

878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d

.exe 268KB

878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d

IMPHASH 6ca9e1c74bf37d3aade4c85b681139d2
SHA256 878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d
MD5 a3857af0103e6a5d79c69ab60751c763
SHA1 bed9065a81aadb31bd34d74f73eb27ae41d8328d
SHA512 ef6c6ae58df670e95c913723632758c11ed69400c647cd839532cfd4a0c4f4fd87e76fedee7db680771b9a43e653bd9ac1c9e6b99499559a26649aaa135441c4
SSDEEP 3072:VfamN+sbPbUfebSM0D7O7qFcSsenSV9FPX:JU8SspVrX
TLSH
T17A44D20273A59822D9664F36887B438AAB36FC552F26D7CF0A5870FC1C727C21D78B59
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CharUpperBuffW LoadStringW

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _strdup _wfopen _wsplitpath _wtol exit fclose feof fgetws free fwrite getenv malloc memcpy memmove memset strchr strcmp strcpy strcspn strlen toupper wcschr wcscpy wcslen wcsrchr wcsstr

kernel32

CloseHandle CompareFileTime CompareStringW CopyFileW CreateDirectoryW CreateFileW FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FormatMessageW GetCommandLineW GetCurrentDirectoryW GetDateFormatW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileTime GetFullPathNameW GetModuleHandleW GetOEMCP GetProcAddress GetStdHandle GetTickCount GetTimeFormatW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LocalFree ReadFile SetFileAttributesW SystemTimeToFileTime WideCharToMultiByte WriteConsoleW WriteFile __chkstk lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

140KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

878b02c606f654bd6b30c392c4a7f9618785f04a0822ea831b0c6c6640fff21d

user32

ucrtbase

kernel32

ntdll

generic