44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2

Sharing

Copy URL Twitter E-mail

General

Target
44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2
Size 441KB
Sample260907-yhszcssxex
SHA256 44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2
MD5 658bf81ca83c561829ecec5fbce608a7
SHA1 046ab50d86bbc3ca822e75f2d698b31a87dce3f3
SHA512 ff7d1d8c4b94ea8782c184d3489e3e5c4401f59abdedcc3ef10ebcdbb520ca1abb238e2ad694445affe0131e3b75717342ecb32fc8da4424c69eea1697a79454
SSDEEP 6144:8BSVOnYgnTZh8Hvrt33Ci89ssTkzWq/K5SFg8ohdtpqeQ2K498:8BDnY2POL8B8oXfHu
TLSH
T163A4F68963E008EAD9E2417A69134571F7E27CDB3B65CB5F42D0331A6E372C0DE2A671
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2

File Explorer

44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2

.exe 441KB

44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2

IMPHASH 8e5394072c83a9a7e942c574a7a96cde
SHA256 44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2
MD5 658bf81ca83c561829ecec5fbce608a7
SHA1 046ab50d86bbc3ca822e75f2d698b31a87dce3f3
SHA512 ff7d1d8c4b94ea8782c184d3489e3e5c4401f59abdedcc3ef10ebcdbb520ca1abb238e2ad694445affe0131e3b75717342ecb32fc8da4424c69eea1697a79454
SSDEEP 6144:8BSVOnYgnTZh8Hvrt33Ci89ssTkzWq/K5SFg8ohdtpqeQ2K498:8BDnY2POL8B8oXfHu
TLSH
T163A4F68963E008EAD9E2417A69134571F7E27CDB3B65CB5F42D0331A6E372C0DE2A671
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\KYD100_SourceCode\quick-access-v3_3032_PSOSD\quick-access-v3_3032\Bin\Release\QALockHandler.pdb

kernel32

HeapDestroy DeleteCriticalSection GetProcessHeap GetEnvironmentVariableW CreateMutexW ProcessIdToSessionId SetEvent CloseHandle WTSGetActiveConsoleSessionId GetCurrentProcessId WideCharToMultiByte SizeofResource LockResource FindResourceExW LoadResource FindResourceW CreateFileW ReadConsoleW WriteConsoleW DecodePointer SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx SetStdHandle HeapFree GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetACP WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetTimeZoneInformation IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetStringTypeW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RtlUnwindEx FreeLibrary LoadLibraryExW SetEndOfFile

user32

SetTimer FindWindowW SendInput RegisterWindowMessageW PostQuitMessage RegisterPowerSettingNotification KillTimer LoadCursorW GetMessageW DefWindowProcW GetKeyState MapVirtualKeyW keybd_event CreateWindowExW RegisterClassExW LoadAcceleratorsW LoadStringW DispatchMessageW GetRawInputData TranslateAcceleratorW RegisterRawInputDevices TranslateMessage LoadIconW

advapi32

RegCreateKeyExW RegSetValueExW GetUserNameW RegCloseKey RegOpenKeyExW RegQueryValueExW

ole32

CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize

oleaut32

VariantInit VariantChangeType VariantClear

imagehlp

MakeSureDirectoryPathExists

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

1024B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

588KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

44b6bd6dd69f07b4840c3d0323c4d456ef1374e12db738a7a7a8af3d8d449ce2

kernel32

user32

advapi32

ole32

oleaut32

imagehlp

wtsapi32

generic