a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7

Sharing

Copy URL Twitter E-mail

General

Target
a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7
Size 451KB
Sample260907-eyrlpawye1
SHA256 a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7
MD5 63c016809b4bc6ae1518bf3ecf61f23d
SHA1 967252b71359bf1fa1289edac1634a240b81b8de
SHA512 1c696e37636c0f454d16cb4199edfe172bafa69ce7b5638243845882f26d20830bfdd942204f6ac9a8676882939e20e476916bc5f0e02de475c0e3cdb3264c5a
SSDEEP 6144:kaHNZHKLNMoPccBC7ujJekfkAEwVCpY/kh0B8EN5w9tRo+94LUlQ18eJQc7kmZGl:3HNZHKHc4Jeoh64P7KSTcP2Rxs4
TLSH
T1E2A4D81776A89ADADC27613C97CFA30D71367CB003A391D7932216221A5B7E8897FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7

File Explorer

a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7

.dll 451KB

a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7

IMPHASH 9a14a1b155c2789136576e7fef0bb72b
SHA256 a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7
MD5 63c016809b4bc6ae1518bf3ecf61f23d
SHA1 967252b71359bf1fa1289edac1634a240b81b8de
SHA512 1c696e37636c0f454d16cb4199edfe172bafa69ce7b5638243845882f26d20830bfdd942204f6ac9a8676882939e20e476916bc5f0e02de475c0e3cdb3264c5a
SSDEEP 6144:kaHNZHKLNMoPccBC7ujJekfkAEwVCpY/kh0B8EN5w9tRo+94LUlQ18eJQc7kmZGl:3HNZHKHc4Jeoh64P7KSTcP2Rxs4
TLSH
T1E2A4D81776A89ADADC27613C97CFA30D71367CB003A391D7932216221A5B7E8897FF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

207856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegOpenKeyW RegSetValueExW

shell32

ILCombine PathYetAnotherMakeUniqueName SHGetDesktopFolder SHGetFolderPathW SHGetPathFromIDListW SHGetSpecialFolderPathW

user32

LoadStringW RegisterClipboardFormatW

shlwapi

PathAppendW PathFileExistsW PathFindExtensionW PathFindFileNameW PathIsDirectoryW PathRemoveExtensionW PathRemoveFileSpecW StrRetToBufW

msvcrt

__iob_func _aligned_free _aligned_malloc _amsg_exit _assert _beginthreadex _errno _fpreset _initterm _iob _lock _lock_file _memicmp _onexit _snprintf _unlock _unlock_file _vscwprintf _vsnprintf _vswprintf _wcsicmp abort bsearch calloc fflush fputc free fwrite getenv iswspace localeconv malloc mbrtowc memchr memcmp memcpy memmove memset realloc signal sprintf strchr strcmp strcpy strcspn strerror strlen strncmp strnlen strrchr vfprintf vsprintf wcrtomb wcscat wcschr wcscpy wcslen wcsnlen wcstol wcstoul

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileW CreateFileW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FindResourceW FlsAlloc FlsGetValue FlsSetValue FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetThreadId GetTickCount GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc LockResource MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable lstrcmpiW lstrlenW

ntdll

vDbgPrintExWithPrefix

Name

.text

Size

207KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a4ebcbf66d15700210b2119dde8dc5390d3cc4f6c5a81c7c1397822a54cd70f7

advapi32

shell32

user32

shlwapi

msvcrt

kernel32

ntdll

generic