28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e

Sharing

Copy URL Twitter E-mail

General

Target
28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e
Size 1.4MB
Sample260910-mj3dms1gqa
SHA256 28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e
MD5 fa7c92755ce2461e07dd46495f05f3bd
SHA1 726f2d6e9b1664634d0c4b3bd4d936ec2da2aebd
SHA512 a38a7dfaa6288b0a901b03f478a1730cae448f91c62cdb1c5f0fd42edc32cea03ef1007a7b9446e6bf75d3f2c046d0d5b5cb5adff122a9fc36c8514dc4bb0c4c
SSDEEP 24576:LCZgN3/bwJdCBPy3+EA2oIfiKf6fqIB8Rpkahzmut6tXcvtWdjDjp:OZgtbwOBcJoxKf6fZ8kahzMX00f
TLSH
T176657D57E2A344F8C96FC0748A679772B970B86942347E2E1A94D7313F21E605F6EB30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e

File Explorer

28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e

.exe 1.4MB

28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e

IMPHASH 1715bfc73d479325d142c6198ccce6cb
SHA256 28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e
MD5 fa7c92755ce2461e07dd46495f05f3bd
SHA1 726f2d6e9b1664634d0c4b3bd4d936ec2da2aebd
SHA512 a38a7dfaa6288b0a901b03f478a1730cae448f91c62cdb1c5f0fd42edc32cea03ef1007a7b9446e6bf75d3f2c046d0d5b5cb5adff122a9fc36c8514dc4bb0c4c
SSDEEP 24576:LCZgN3/bwJdCBPy3+EA2oIfiKf6fqIB8Rpkahzmut6tXcvtWdjDjp:OZgtbwOBcJoxKf6fZ8kahzMX00f
TLSH
T176657D57E2A344F8C96FC0748A679772B970B86942347E2E1A94D7313F21E605F6EB30
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileA CreateFileMappingA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FormatMessageA FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoW GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GlobalMemoryStatusEx InitializeCriticalSection IsWow64Process LeaveCriticalSection LoadLibraryA LocalFree MapViewOfFile OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableA SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _endthreadex _errno _exit _set_app_type _initialize_wide_environment _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _get_osfhandle _lseeki64 _read _setmode _wfopen _write fclose fflush fopen fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _wcsicmp iswctype memset strcmp strcoll strlen strncmp strnlen strxfrm towlower towupper wcscoll wcscpy wcslen wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayUnaccessData SysAllocString SysFreeString VariantClear VariantInit

shlwapi

PathAppendW

Name

.text

Size

806KB

Virtual Size

805KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

28020cc80067fe6707d74b226cb0d8548971ed121aa9afd85093196b9fcd788e

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

shlwapi

generic