2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45

General

Target
2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45
Size 476KB
Sample260916-28m3kstyhs
SHA256 2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45
MD5 eff5b72bfb66abc46bf07fd21c44f978
SHA1 472b6387b58c026696cc15fc0c724803c05b5150
SHA512 23357d11189ec43465c6af606a459a91dfcfd7d3b564d8b3227430182ff9760cdac0ecd68bb7122aae0182be1e31c39458ea10659f5c584c37db6c6e0da7b05d
SSDEEP 12288:TT0pQEYVkFmW7qE+bsIH6bNE3ecNuAHhlyc4DR:HVEYVkFmW7q5bsdbS7NuA
TLSH
T161A44902A33181BDC95AC5389677A333F9707C5DC629EB239FD082612F56F90963EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45

File Explorer

2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45

.dll 476KB

2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45

IMPHASH 5fca276c60cbefd8d33b55159828aa9f
SHA256 2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45
MD5 eff5b72bfb66abc46bf07fd21c44f978
SHA1 472b6387b58c026696cc15fc0c724803c05b5150
SHA512 23357d11189ec43465c6af606a459a91dfcfd7d3b564d8b3227430182ff9760cdac0ecd68bb7122aae0182be1e31c39458ea10659f5c584c37db6c6e0da7b05d
SSDEEP 12288:TT0pQEYVkFmW7qE+bsIH6bNE3ecNuAHhlyc4DR:HVEYVkFmW7q5bsdbS7NuA
TLSH
T161A44902A33181BDC95AC5389677A333F9707C5DC629EB239FD082612F56F90963EB25
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

191588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualProtect LoadLibraryA GetProcessHeap HeapAlloc HeapFree GetSystemTimeAsFileTime GetFileSizeEx WaitForSingleObject ReleaseMutex GetModuleHandleA CloseHandle GetLastError GetTickCount GetProcAddress GetModuleFileNameW CreateMutexA GetCurrentProcessId SwitchToThread IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte FreeLibrary QueryPerformanceCounter GetCurrentThreadId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwindEx LoadLibraryExW InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetStringTypeW GetACP LCMapStringW GetStdHandle GetFileType WriteFile GetConsoleCP GetConsoleMode FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers SetStdHandle CreateFileW SetFilePointerEx WriteConsoleW HeapSize HeapReAlloc

Sharing

General

Malware Config

Signatures

File Explorer

2b22af6b7e28cae69222cb7398820907b694c37e799a7e89eb9db9db9ddead45

kernel32

generic