1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163

General

Target
1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163
Size 255KB
Sample260916-1jdbeaef25
SHA256 1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163
MD5 9b30cb74280de77ce6e62c76854ed257
SHA1 88a82431a3e8350be2773d1fd11c231d84b2bb56
SHA512 9af1bf7df5922c76b99b108c0669698da3fb457058a56f6f3fa089e8a8702131122a16d2e4ab7cde72eb5b48fac7a646cb4bdaede417a729c19597e63b866194
SSDEEP 6144:vPLdLB+10dIdMA2PgIsOmjJ2OMtbdJUAyc1A827fbk+dVUmMSwsRd:vBLB+OdC24IiJ2OMtbdJUAygA8UDk+dD
TLSH
T12A446B0765C082F6D8520EB8B0277766AD325A25582797E7FFD01D3EBD32B4384A770A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163

File Explorer

1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163

.exe 255KB

1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163

IMPHASH c5eac633cad40ab7d8df68832e550a9e
SHA256 1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163
MD5 9b30cb74280de77ce6e62c76854ed257
SHA1 88a82431a3e8350be2773d1fd11c231d84b2bb56
SHA512 9af1bf7df5922c76b99b108c0669698da3fb457058a56f6f3fa089e8a8702131122a16d2e4ab7cde72eb5b48fac7a646cb4bdaede417a729c19597e63b866194
SSDEEP 6144:vPLdLB+10dIdMA2PgIsOmjJ2OMtbdJUAyc1A827fbk+dVUmMSwsRd:vBLB+OdC24IiJ2OMtbdJUAygA8UDk+dD
TLSH
T12A446B0765C082F6D8520EB8B0277766AD325A25582797E7FFD01D3EBD32B4384A770A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

11

Major OS version

1

Entry point

178560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

CharUpperA MessageBoxA

ws2_32

WSAAccept WSAGetLastError WSASocketA WSAStartup __WSAFDIsSet bind closesocket connect gethostbyname gethostname getpeername getsockname getsockopt htonl htons ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown

kernel32

CloseHandle CreateEventA CreateFileA CreatePipe CreateProcessA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileA FlushFileBuffers FormatMessageA FreeConsole GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetCurrentDirectoryA GetCurrentProcessId GetCurrentThreadId GetDriveTypeA GetExitCodeProcess GetFileAttributesA GetFileType GetFullPathNameA GetLastError GetLocalTime GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetOEMCP GetProcAddress GetStdHandle GetTickCount GetTimeZoneInformation GetVersionExA GetVersion InitializeCriticalSection LeaveCriticalSection LoadLibraryA MultiByteToWideChar ReadConsoleInputA ReadFile ResumeThread SearchPathA SetConsoleCtrlHandler SetConsoleMode SetEndOfFile SetEnvironmentVariableA SetFilePointer SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleA WriteFile

advapi32

CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegisterServiceCtrlHandlerA SetServiceStatus StartServiceA StartServiceCtrlDispatcherA

Sharing

General

Malware Config

Signatures

File Explorer

1fef561e39068f607ff78284fa5b1487ec63445c218db20934ca1fe36aae3163

user32

ws2_32

kernel32

advapi32

generic