2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82

Sharing

Copy URL Twitter E-mail

General

Target
2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82
Size 6.7MB
Sample260916-3gc9qsgp2x
SHA256 2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82
MD5 4f9f0ee819d04528dde2398607fa8bd7
SHA1 5ad548b47883bc9c8685d68a3dac85f148c14c2c
SHA512 107560004b3a8384f947a990c391ea3cf9d5439f4e18dd207f0286b88dc79e207fb48d9a3ff01bf44be20f13855a36c35b558e868cd10f6a69c8659c567ad2a8
SSDEEP 49152:Ew9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
TLSH
T14B66AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82

File Explorer

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82

.exe 6.7MB

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82

IMPHASH db509f0d296d268770c3b20bf5581bd7
SHA256 2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82
MD5 4f9f0ee819d04528dde2398607fa8bd7
SHA1 5ad548b47883bc9c8685d68a3dac85f148c14c2c
SHA512 107560004b3a8384f947a990c391ea3cf9d5439f4e18dd207f0286b88dc79e207fb48d9a3ff01bf44be20f13855a36c35b558e868cd10f6a69c8659c567ad2a8
SSDEEP 49152:Ew9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w9w:ZKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
TLSH
T14B66AE07B3D1C262C5824675CAA15AF6E770AF3987124FD3A3487F0ABE712D0CDB159A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memset strncmp memmove strncpy strstr _strnicmp _stricmp strlen strcmp memcpy sprintf fabs ceil malloc floor free fclose strcpy tolower

kernel32

GetModuleHandleA HeapCreate GetCommandLineA RemoveDirectoryA GetTempFileNameA GetShortPathNameA GetWindowsDirectoryA GetSystemDirectoryA HeapDestroy ExitProcess GetExitCodeProcess GetNativeSystemInfo FindResourceA LoadResource SizeofResource HeapAlloc HeapFree Sleep LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId GetCurrentProcessId CloseHandle InitializeCriticalSection GetModuleFileNameA GetEnvironmentVariableA SetEnvironmentVariableA CreateFileA ReadFile WriteFile SetFilePointer DeleteFileA GetFileSize HeapReAlloc GetCurrentProcess TerminateProcess SetUnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection GetVersionExA SetLastError HeapSize TlsAlloc GetCurrentDirectoryA SetCurrentDirectoryA GetTempPathA SetFileAttributesA CreateDirectoryA DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte

user32

CharUpperA CharLowerA MessageBoxA SendMessageA PostMessageA GetWindowThreadProcessId IsWindowVisible GetWindowLongA GetForegroundWindow IsWindowEnabled EnableWindow EnumWindows SetWindowPos DestroyWindow GetDC GetWindowTextLengthA GetWindowTextA SetRect DrawTextA GetSystemMetrics ReleaseDC GetSysColor GetSysColorBrush CreateWindowExA CallWindowProcA SetWindowLongA SetFocus RedrawWindow RemovePropA DefWindowProcA SetPropA GetParent GetPropA GetWindow SetActiveWindow UnregisterClassA DestroyAcceleratorTable LoadIconA LoadCursorA RegisterClassA AdjustWindowRectEx ShowWindow CreateAcceleratorTableA PeekMessageA MsgWaitForMultipleObjects GetMessageA GetActiveWindow TranslateAcceleratorA TranslateMessage DispatchMessageA GetFocus GetClientRect FillRect EnumChildWindows DefFrameProcA GetWindowRect IsChild GetClassNameA GetKeyState DestroyIcon RegisterWindowMessageA

gdi32

GetStockObject SelectObject SetBkColor SetTextColor GetTextExtentPoint32A CreateSolidBrush DeleteObject GetObjectA CreateCompatibleDC GetDIBits DeleteDC GetObjectType CreateDIBSection BitBlt CreateBitmap SetPixel

comctl32

InitCommonControlsEx

ole32

CoInitialize CoTaskMemFree RevokeDragDrop

shell32

ShellExecuteExA

winmm

timeBeginPeriod

shlwapi

PathQuoteSpacesA PathGetArgsA PathAddBackslashA PathRenameExtensionA PathUnquoteSpacesA

Sharing

General

Malware Config

Signatures

File Explorer

2cfc8545ca309e464a3596acb3eac9404c50b89efa5337564e1d7189a5f0fd82

msvcrt

kernel32

user32

gdi32

comctl32

ole32

shell32

winmm

shlwapi

generic