6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee

Sharing

Copy URL Twitter E-mail

General

Target
6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee
Size 377KB
Sample260916-ltwheahq5x
SHA256 6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee
MD5 edfd63e1fe84682f57b911f52195d88b
SHA1 3d9c97b206a379c228ac0da002717c20a83f734c
SHA512 6bfe61065f351f6764319715ac4c0aa13b185ac275cf9a379cb7e2a4744e149524164d3abcdab03ca25002b4c00d9812e6ab2e78b0f4aa0fa4d0221b9c78dd08
SSDEEP 6144:ICUjb85ga7KiTS6Qq/dHacrBaFfpu/FvsoXrT+yMpbgRR6PcnL5VDbE9r:ICUH85gkRrpdo1p4vsMwctnd5Y9r
TLSH
T16984CF5A6F2663BEEC1480B7CC0690D5A09D6B221F1D0C7BBFE95AED94F3573C66A004
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee

File Explorer

6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee

.exe 377KB

6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee

IMPHASH aae0990bf8ae1af65a22e31d4163da6c
SHA256 6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee
MD5 edfd63e1fe84682f57b911f52195d88b
SHA1 3d9c97b206a379c228ac0da002717c20a83f734c
SHA512 6bfe61065f351f6764319715ac4c0aa13b185ac275cf9a379cb7e2a4744e149524164d3abcdab03ca25002b4c00d9812e6ab2e78b0f4aa0fa4d0221b9c78dd08
SSDEEP 6144:ICUjb85ga7KiTS6Qq/dHacrBaFfpu/FvsoXrT+yMpbgRR6PcnL5VDbE9r:ICUH85gkRrpdo1p4vsMwctnd5Y9r
TLSH
T16984CF5A6F2663BEEC1480B7CC0690D5A09D6B221F1D0C7BBFE95AED94F3573C66A004
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42852

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

WritePrivateProfileStringA WriteFile WaitForSingleObject Sleep ReadFile LoadLibraryA GetWindowsDirectoryA GetVersionExA GetTempPathA GetSystemDirectoryA GetProcAddress GetModuleHandleA GetModuleFileNameA GetLastError GetFileAttributesA GetCurrentDirectoryA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess DeleteFileA CreateThread CreateMutexA CreateFileA CreateDirectoryA CopyFileA CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetThreadLocale GetStartupInfoA GetModuleFileNameA GetLocaleInfoA GetLastError GetCommandLineA FreeLibrary ExitProcess CreateThread WriteFile UnhandledExceptionFilter SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetFileType CreateFileA CloseHandle

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

mpr

WNetCancelConnectionA WNetAddConnection2A

oleaut32

SysFreeString

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

user32

GetKeyboardType MessageBoxA CharNextA

wininet

InternetGetConnectedState

wsock32

WSACleanup WSAStartup gethostbyname socket send recv inet_ntoa inet_addr htons connect closesocket

Sharing

General

Malware Config

Signatures

File Explorer

6b54b443076dbab3d9697ea4271ac44902bac70dd843513966d140350a145aee

kernel32

advapi32

mpr

oleaut32

shell32

urlmon

user32

wininet

wsock32

generic