47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7

Sharing

Copy URL Twitter E-mail

General

Target
47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7
Size 1.7MB
Sample260905-db36jadp3s
SHA256 47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7
MD5 61b9b75802ffc64e2ce6469414d0771a
SHA1 d094a5923069bb7a9d6794ce6b1af71a12141d8e
SHA512 ae5637f7624bff95ce733676da40358873ebf15d47ced4e4012e79272ac38f1d1d4a39bcfd568235962e373ee6c97157ac39e3ab6ece676fa922f1b3728f5b1e
SSDEEP 24576:iy26Xz8wnDJ4pmBzPdVEKwd8yZdUMDqCoAU9pxGFkGPH1jEEQs:ZdD7VEKwd8yn9U9pxGFDH5ERs
TLSH
T15485AF16A6A801FDD1B7D1B88A678543E772780A0335AFEF03D056662F2B7D44E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7

File Explorer

47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7

.exe 1.7MB

47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7

IMPHASH 65ffadf271018806ad95944d4f92c51a
SHA256 47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7
MD5 61b9b75802ffc64e2ce6469414d0771a
SHA1 d094a5923069bb7a9d6794ce6b1af71a12141d8e
SHA512 ae5637f7624bff95ce733676da40358873ebf15d47ced4e4012e79272ac38f1d1d4a39bcfd568235962e373ee6c97157ac39e3ab6ece676fa922f1b3728f5b1e
SSDEEP 24576:iy26Xz8wnDJ4pmBzPdVEKwd8yZdUMDqCoAU9pxGFkGPH1jEEQs:ZdD7VEKwd8yn9U9pxGFDH5ERs
TLSH
T15485AF16A6A801FDD1B7D1B88A678543E772780A0335AFEF03D056662F2B7D44E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

670960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile WritePrivateProfileStringW UnmapViewOfFile CreateFileMappingW MapViewOfFile Sleep GetCurrentProcessId LoadLibraryW GetProcAddress GetModuleHandleA LoadLibraryA InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW DecodePointer GetModuleFileNameW HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetTempPathW WaitNamedPipeW ReadFile CreateFileW GetCurrentProcess FindResourceW LoadResource SizeofResource LockResource LoadLibraryExW GetFileAttributesW FreeLibrary GetProcessTimes GetSystemTimeAsFileTime IsWow64Process SetLastError QueryFullProcessImageNameW GetFileSizeEx ResumeThread WaitForSingleObject LocalFree CreateDirectoryW SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetLastError CloseHandle MultiByteToWideChar GetPrivateProfileStringW WideCharToMultiByte GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect ReadConsoleW GetConsoleMode GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType SetFilePointerEx FlushFileBuffers GetConsoleOutputCP RtlUnwind

user32

SetProcessDPIAware MessageBoxA MessageBoxW

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHGetFolderPathW SHCreateDirectoryExW

ole32

CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate

mscoree

CLRCreateInstance

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

PlaySoundW

Name

.text

Size

856KB

Virtual Size

855KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

543KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

47b6962c3fc30b7a6e3f3e85bee344477ab0622dce022b56b72435096fb33ae7

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

version

winmm

generic