26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4

Sharing

Copy URL Twitter E-mail

General

Target
26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4
Size 195KB
Sample260916-2klvlsfb56
SHA256 26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4
MD5 2864b037723a5b7ce274b559b7a01da1
SHA1 569cb23c4db18f3ebfb17e757485df583dcb3b8c
SHA512 e87f9bab6630e8aceedaeea7f26abc5e2f369367a2ac2edae041a00c3c3c2f770b46fbb7c19dc48f197b1b9fdeed85ec352d486411355ae35eb10ae02fc689aa
SSDEEP 6144:pIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCyON:QKofHfHTXQLzgvnzHPowYbvrjD/L7QPL
TLSH
T184143B3EF5075AF7EE2908B845C6F1BE1612A538B4978E71E740CD29E8F2CA8355D702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4

File Explorer

26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4

.exe 195KB

26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4

IMPHASH 4ef23820f834df2be399d0ac2d982700
SHA256 26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4
MD5 2864b037723a5b7ce274b559b7a01da1
SHA1 569cb23c4db18f3ebfb17e757485df583dcb3b8c
SHA512 e87f9bab6630e8aceedaeea7f26abc5e2f369367a2ac2edae041a00c3c3c2f770b46fbb7c19dc48f197b1b9fdeed85ec352d486411355ae35eb10ae02fc689aa
SSDEEP 6144:pIs9OKofHfHTXQLzgvnzHPowYbvrjD/L7QPbg/Dr0T3rnXLHf7zjPFsEPAsKCyON:QKofHfHTXQLzgvnzHPowYbvrjD/L7QPL
TLSH
T184143B3EF5075AF7EE2908B845C6F1BE1612A538B4978E71E740CD29E8F2CA8355D702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext LookupPrivilegeValueA OpenProcessToken RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

AddAtomA CloseHandle CopyFileA CreateFileA CreateFileMappingA CreateMutexA CreateProcessA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteFileA ExitProcess FindAtomA FindClose FindFirstFileA FindNextFileA FreeLibrary GetAtomNameA GetCurrentProcess GetCurrentProcessId GetDriveTypeA GetFileSize GetFileTime GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessHeap GetSystemDirectoryA GetSystemTime GetTickCount GetVersionExA GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc InterlockedDecrement InterlockedIncrement IsBadReadPtr IsDebuggerPresent LoadLibraryA MapViewOfFile OpenProcess Process32First Process32Next ReadFile ReleaseSemaphore SetErrorMode SetFilePointer SetFileTime SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteFile lstrcatA lstrcmpA lstrcpyA lstrcpynA lstrlenA

msvcrt

_itoa __getmainargs __p__environ __p__fmode __set_app_type _cexit _iob _onexit _setmode abort atexit atoi fclose fflush fgetc fopen fprintf fread free fseek ftell malloc memcpy memmove memset rand realloc rewind signal sprintf srand sscanf _mbscat strchr strcmp _mbscpy strstr strtok

user32

CharLowerA wsprintfA

dnsapi

DnsQuery_A

wininet

InternetGetConnectedState

ws2_32

WSAConnect WSASocketA WSAStartup closesocket connect gethostbyname gethostname htons inet_addr inet_ntoa recv send sendto setsockopt socket

Name

4429ddrn

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

44z6ftco

Size

39KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

v75gkffk

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

dMrQUrpm

Size

1KB

Virtual Size

1KB

Characteristics

Name

wTdzgxdL

Size

17KB

Virtual Size

17KB

Characteristics

Name

EBcQahwr

Size

512B

Virtual Size

55B

Characteristics

Name

FQXfMeYO

Size

4KB

Virtual Size

3KB

Characteristics

Name

hKmyjwiO

Size

512B

Virtual Size

283B

Characteristics

Name

PXGYXprF

Size

1024B

Virtual Size

843B

Characteristics

Name

hNfGxQeL

Size

46KB

Virtual Size

46KB

Characteristics

Name

nSMexQnR

Size

1024B

Virtual Size

1008B

Characteristics

Name

VGiRpyFT

Size

2KB

Virtual Size

2KB

Characteristics

Name

HHmipRio

Size

1024B

Virtual Size

722B

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

26c2ba1cdf0172c097392d340a38a155e9389109cae6ff536ccacc24f721cdb4

advapi32

kernel32

msvcrt

user32

dnsapi

wininet

ws2_32

generic