448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd

Sharing

Copy URL Twitter E-mail

General

Target
448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd
Size 595KB
Sample260910-s8kssadn8x
SHA256 448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd
MD5 98522a8c481cd5c5ae2be12b66a823c5
SHA1 510fda565fc5fe43466e9b1917fa1f32f4b83cb8
SHA512 fa54e165ccb43c95ea976614c291d1241bd1566940630e7298647e1cb1d82708e73d69c26623b9071a99e5aefd256b997d4dba13c4755d0e98aa29f96f651d08
SSDEEP 12288:nxooTE8MlCDWwJkkWS5XbDflLlUyWT/mvBeoXQ7+ClOIOLqBmZ:0yWwrB53dL6yWrmvYoXMBNmZ
TLSH
T1EDD423903F85953ED00651B85E09F938AC2DDB3D24A1C6DADBA1FA89AF953A1413C273
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd

File Explorer

448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd

.exe 595KB

448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd

IMPHASH 4e73db19151d1ed485c4843f251684e3
SHA256 448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd
MD5 98522a8c481cd5c5ae2be12b66a823c5
SHA1 510fda565fc5fe43466e9b1917fa1f32f4b83cb8
SHA512 fa54e165ccb43c95ea976614c291d1241bd1566940630e7298647e1cb1d82708e73d69c26623b9071a99e5aefd256b997d4dba13c4755d0e98aa29f96f651d08
SSDEEP 12288:nxooTE8MlCDWwJkkWS5XbDflLlUyWT/mvBeoXQ7+ClOIOLqBmZ:0yWwrB53dL6yWrmvYoXMBNmZ
TLSH
T1EDD423903F85953ED00651B85E09F938AC2DDB3D24A1C6DADBA1FA89AF953A1413C273
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegConnectRegistryA OpenSCManagerA LockServiceDatabase OpenServiceA ChangeServiceConfigA StartServiceA CloseServiceHandle UnlockServiceDatabase EnumServicesStatusA ControlService DeleteService

shell32

FindExecutableA ShellExecuteA

mpr

WNetAddConnection2A WNetCancelConnection2A WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetGetConnectionA

kernel32

GetDriveTypeA GetWindowsDirectoryA GetComputerNameA GetLastError Sleep GetModuleFileNameA GetLocalTime CreateThread OpenMutexA ReleaseMutex CreateMutexA CloseHandle GetVersionExA CreateFileA CreateFileMappingA MapViewOfFile WriteFile SetFilePointer FindFirstFileA FindNextFileA FindClose OpenProcess TerminateProcess CreateToolhelp32Snapshot Process32First Process32Next LoadLibraryA GetProcAddress FreeLibrary GetSystemTimeAsFileTime SetConsoleCtrlHandler GetStartupInfoA GetModuleHandleA VirtualAlloc VirtualQuery HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize HeapValidate ExitProcess RtlUnwind GetFileType GetStdHandle GetCurrentProcess DuplicateHandle SetHandleCount GetCommandLineA GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetTimeZoneInformation SetStdHandle DeleteFileA ReadFile SetEndOfFile

user32

GetWindowTextA GetWindowThreadProcessId EnumWindows

ws2_32

socket htonl htons bind recvfrom sendto WSAStartup WSACleanup inet_addr gethostbyname gethostbyaddr

Sharing

General

Malware Config

Signatures

File Explorer

448200d2a3042201c70bf73603d51db474e7f9ef44203527ca424871cf292afd

advapi32

shell32

mpr

kernel32

user32

ws2_32

generic