18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955

General

Target
18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955
Size 1013KB
Sample260910-3yavyaztaz
SHA256 18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955
MD5 d1e31e5590584633f6828e6a3314f104
SHA1 ec568b17a747b9a98019f1dab97ecf74c8fc10a3
SHA512 4af6725fb073617e88bba3cfd80a00e63053844947de800acb5d37a058eb1683c3a5be2fa1b2156f1ba8d2fc0b73f60e7b9fe26a0e2300e9c0db0baf918fa348
SSDEEP 12288:4On9BhYDInjyUr26aICQxBh1LNuRtbtC/rV5TPCuEebfUWi/hBsbrEzM8r+RO5FB:4OnbhY0n7HayFuc2mm3sDRO5T0
TLSH
T1C925D01DA93990DAFCE340B16B199111E432BD378F346ADB41E48B613917EFD0A3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955

File Explorer

18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955

.exe 1013KB

18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955

IMPHASH 534d1f4899e357d483815235b1dd8f02
SHA256 18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955
MD5 d1e31e5590584633f6828e6a3314f104
SHA1 ec568b17a747b9a98019f1dab97ecf74c8fc10a3
SHA512 4af6725fb073617e88bba3cfd80a00e63053844947de800acb5d37a058eb1683c3a5be2fa1b2156f1ba8d2fc0b73f60e7b9fe26a0e2300e9c0db0baf918fa348
SSDEEP 12288:4On9BhYDInjyUr26aICQxBh1LNuRtbtC/rV5TPCuEebfUWi/hBsbrEzM8r+RO5FB:4OnbhY0n7HayFuc2mm3sDRO5T0
TLSH
T1C925D01DA93990DAFCE340B16B199111E432BD378F346ADB41E48B613917EFD0A3E366
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

603512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32EnumProcesses LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

CreateWindowExW DispatchMessageW GetMessageW LoadCursorW TranslateMessage

gdi32

CreateSolidBrush

Name

.text

Size

731KB

Virtual Size

732KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.oep

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

18ba800c0b25dae52a60abf02870c6a09a86afafa36d9e1278992722d08be955

kernel32

user32

gdi32

generic