88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c

Sharing

Copy URL Twitter E-mail

General

Target
88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c
Size 395KB
Sample260916-lp174aad69
SHA256 88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c
MD5 2bb11bb5ce0324b836f095b4fa81d776
SHA1 d24a0d594b264117e435e6893d59ffee6580fb51
SHA512 f0d749129df91fb1d1218efde6d40dd6808a04f8d2f2a1b59b3b15920b2a1a15a29106edece595fedf23ad613deb73744a9431d6ff324bf84b2b853ee62740e5
SSDEEP 6144:6Hxw3ZEgreeE5dkD5FtrA/bn8WopSS2Qma/6YRIuA+TA2GXKs8iC:6Hxw3ZHEO5c/T8FSemk6YGh+82G6ZiC
TLSH
T1A284AF10B652C036E26195B60865EFB6A97A6C718F6165CB73C41FBECD342C26738F0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c

File Explorer

88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c

.exe 395KB

88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c

IMPHASH 772ef0531fb891991485e716f7d813d7
SHA256 88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c
MD5 2bb11bb5ce0324b836f095b4fa81d776
SHA1 d24a0d594b264117e435e6893d59ffee6580fb51
SHA512 f0d749129df91fb1d1218efde6d40dd6808a04f8d2f2a1b59b3b15920b2a1a15a29106edece595fedf23ad613deb73744a9431d6ff324bf84b2b853ee62740e5
SSDEEP 6144:6Hxw3ZEgreeE5dkD5FtrA/bn8WopSS2Qma/6YRIuA+TA2GXKs8iC:6Hxw3ZHEO5c/T8FSemk6YGh+82G6ZiC
TLSH
T1A284AF10B652C036E26195B60865EFB6A97A6C718F6165CB73C41FBECD342C26738F0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

InitCommonControlsEx

advapi32

QueryServiceStatus OpenSCManagerW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegDeleteTreeW CloseServiceHandle ControlService EnumServicesStatusExW OpenServiceW

shell32

SHGetFolderPathW

user32

DestroyIcon LoadCursorW SetWindowLongW GetWindowLongW FillRect LoadImageW GetCursorPos SetCursor MessageBoxW GetClientRect SetWindowTextW EndPaint ScreenToClient UpdateWindow EnableWindow MoveWindow ShowWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW wsprintfW DrawIconEx BeginPaint

gdi32

TextOutW MoveToEx SetTextColor SetBkMode SelectObject LineTo DeleteObject CreateSolidBrush CreatePen CreateFontW

msimg32

GradientFill

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindFirstFileExW GetFileType HeapReAlloc GetOEMCP GetACP IsValidCodePage HeapAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetStdHandle GetProcessHeap SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetCommandLineA LoadLibraryExW GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetLastError SetLastError WaitForSingleObject GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetLocalTime GetWindowsDirectoryW GetModuleHandleW GetProcAddress LocalFree FormatMessageW MoveFileExW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW VirtualProtect RaiseException RtlUnwind FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle GetModuleFileNameW ExitProcess FreeLibrary GetModuleHandleExW IsDebuggerPresent UnhandledExceptionFilter HeapFree WriteConsoleW

Name

.text

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

88fae959b7c5c971234d02f025456bcf6765e7d53fd40366f82b06de22254b1c

comctl32

advapi32

shell32

user32

gdi32

msimg32

kernel32

generic