2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb

Sharing

Copy URL Twitter E-mail

General

Target
2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb
Size 221KB
Sample260906-vq2ppacc43
SHA256 2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb
MD5 467462adef93bc098d4c73759fb0c010
SHA1 a0150631c1031ca250544cd0b17abbc91792f454
SHA512 4d5e455cd0d81c56163c4ac362cf90ec3287c451bed2c6f691bdf73c94ef09cd1616df3da012aa821f83c16c1a20b514f26a6b42a24628beed1e44fd501ff9f6
SSDEEP 3072:k7iuLOGzMvQ+oU9u7BEFn2et88jTpJMAsWK/pleweD4QlBQEhfTneUJMZaV:km1MMr9utEN2efjT3KRoDD4QlBWOMZa
TLSH
T183248C5573E50CF9E8B78239C9528606E77278560770CBEF03A04666AF233E19D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb

File Explorer

2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb

.exe 221KB

2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb

IMPHASH 6021ef2ff1c01d81c99690db5470488c
SHA256 2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb
MD5 467462adef93bc098d4c73759fb0c010
SHA1 a0150631c1031ca250544cd0b17abbc91792f454
SHA512 4d5e455cd0d81c56163c4ac362cf90ec3287c451bed2c6f691bdf73c94ef09cd1616df3da012aa821f83c16c1a20b514f26a6b42a24628beed1e44fd501ff9f6
SSDEEP 3072:k7iuLOGzMvQ+oU9u7BEFn2et88jTpJMAsWK/pleweD4QlBQEhfTneUJMZaV:km1MMr9utEN2efjT3KRoDD4QlBWOMZa
TLSH
T183248C5573E50CF9E8B78239C9528606E77278560770CBEF03A04666AF233E19D3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse

advapi32

RegQueryValueExA RegCreateKeyExA GetUserNameA RegSetValueExA RegCloseKey RegOpenKeyExA RegDeleteValueA

iphlpapi

GetAdaptersInfo

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetFolderPathA

d3d11

D3D11CreateDevice

kernel32

FlushFileBuffers GetConsoleOutputCP GetConsoleMode CreateFileW SetFilePointerEx HeapSize ReadConsoleW SetEndOfFile WriteConsoleW RtlLookupFunctionEntry GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA GetFileAttributesExA GetFullPathNameA RemoveDirectoryA WriteFile GetTempPathA OutputDebugStringA CloseHandle GetLastError WaitForSingleObject CreateMutexA Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessA OpenProcess GetModuleFileNameA GetModuleHandleA GetProcAddress OpenMutexA QueryFullProcessImageNameA CopyFileA GetComputerNameA MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindFirstFileA FindNextFileA GetFileSizeEx ReadFile SetHandleInformation CreatePipe PeekNamedPipe GlobalMemoryStatusEx GetTickCount GetVersionExA WideCharToMultiByte QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess IsValidCodePage RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType GetTimeZoneInformation HeapReAlloc FindFirstFileExW FindNextFileW

Name

.text

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2b58e49d36f1ec287fa6662aa8ef96a5df79aeb8f1c17ad28ad5e3a8190537bb

winhttp

advapi32

iphlpapi

ole32

shell32

d3d11

kernel32

generic