64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c

General

Target
64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c
Size 5.2MB
Sample260907-cmkmwsvtft
SHA256 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c
MD5 b028a546983129cdb135fb30c583889a
SHA1 6d6a54d40109f583ef78a36c97110c86d54572ca
SHA512 c40eaec5a837b74f1b47210fe2fb5a26f0f1407e80deafa327f40b87ef07f06faa9951394e95d03359140129a981f0f6c44d60822adfc4275adfb25d0b9e08f6
SSDEEP 98304:9N6ynFMPDpKmj4rcETYsTdvlh0AMPVybmHz9JWzPjQs/3r:X6yQcWsK0Prr
TLSH
T16B466B21B69BC126D66F06712A2CDB6F51793EA12FB340DBA3D45E6E08B58C14331F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c

File Explorer

64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c

.exe 5.2MB

64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c

IMPHASH d8bb7ff20ee28065e7f762f91eee2327
SHA256 64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c
MD5 b028a546983129cdb135fb30c583889a
SHA1 6d6a54d40109f583ef78a36c97110c86d54572ca
SHA512 c40eaec5a837b74f1b47210fe2fb5a26f0f1407e80deafa327f40b87ef07f06faa9951394e95d03359140129a981f0f6c44d60822adfc4275adfb25d0b9e08f6
SSDEEP 98304:9N6ynFMPDpKmj4rcETYsTdvlh0AMPVybmHz9JWzPjQs/3r:X6yQcWsK0Prr
TLSH
T16B466B21B69BC126D66F06712A2CDB6F51793EA12FB340DBA3D45E6E08B58C14331F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1190119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap RemoveDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW MoveFileW GetLastError SizeofResource LockResource LoadResource FindResourceW FindResourceExW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW SetEvent InitializeCriticalSection lstrcpynW WaitForSingleObject CreateThread GetProcAddress LoadLibraryExW DecodePointer Sleep GetDiskFreeSpaceExW GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW FindFirstFileW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SystemTimeToFileTime FindClose MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetSystemInfo WaitForMultipleObjects ReadConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetEnvironmentStringsW FormatMessageW LocalFree LoadLibraryA GetModuleFileNameA GetFullPathNameW GetCurrentThread GetConsoleOutputCP FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW GetSystemTime CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo LCMapStringW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind ExitProcess GetModuleHandleExW GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetStdHandle WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

64db89055ed4820e38f5a236468a5c79b4524679a2ad43bd6338f85180e5590c

kernel32

generic