13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885

Sharing

Copy URL Twitter E-mail

General

Target
13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885
Size 293KB
Sample260916-ma6ppss16j
SHA256 13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885
MD5 f794baf8f30f9cd86f3d82c7bd6c7390
SHA1 b4b1867fea7af711f3bba36090be56f87926d312
SHA512 bcf5d31cbb63f21416478c83a1c612cef962fc8c41300cc356c9abc11532cb0adfd65ea2849b842edfdb4306bdcf2574e65299488f172e8f9e09ebcd9bbfcf11
SSDEEP 6144:BsMto5xFn6cp6dU2wIgy+aUmfFBouz2hd:BsUQn6cZfuU2oh
TLSH
T157542A1FE7969BABC91714B05ACED16D0139F9A08F218B0BD3780C1269D3B987F6532D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885

File Explorer

13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885

.dll 293KB

13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885

IMPHASH e7bb37b0afa08ed7a4794ba0ed7cff9d
SHA256 13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885
MD5 f794baf8f30f9cd86f3d82c7bd6c7390
SHA1 b4b1867fea7af711f3bba36090be56f87926d312
SHA512 bcf5d31cbb63f21416478c83a1c612cef962fc8c41300cc356c9abc11532cb0adfd65ea2849b842edfdb4306bdcf2574e65299488f172e8f9e09ebcd9bbfcf11
SSDEEP 6144:BsMto5xFn6cp6dU2wIgy+aUmfFBouz2hd:BsUQn6cZfuU2oh
TLSH
T157542A1FE7969BABC91714B05ACED16D0139F9A08F218B0BD3780C1269D3B987F6532D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlAllocateHandle RtlFreeHandle RtlInitializeHandleTable RtlIsValidHandle RtlRaiseException vDbgPrintExWithPrefix

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

kernel32

AddAtomW CompareStringW DeleteAtom DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeLibrary GetAtomNameW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GetUserDefaultUILanguage GetVersionExA GlobalAddAtomW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsBadReadPtr LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MulDiv QueryPerformanceCounter RaiseException SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery lstrcatW lstrcmpiW lstrcpyW lstrcpynW lstrlenW

msvcrt

__dllonexit _amsg_exit _assert _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _wsplitpath abort bsearch calloc free fwrite isspace memcmp memmove sprintf sscanf strchr strcmp strcpy strcspn strncmp vfprintf wcschr wcscmp wcsncpy

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreatePatternBrush CreatePen CreateRectRgn CreateRectRgnIndirect CreateSolidBrush DeleteDC DeleteObject ExtCreateRegion GdiDrawStream GetClipRgn GetDeviceCaps GetObjectW GetStockObject GetTextColor GetTextMetricsW IntersectClipRect LineTo MoveToEx OffsetViewportOrgEx PatBlt Polygon Polyline SelectClipRgn SelectObject SetBkMode SetTextColor SetViewportOrgEx SetWindowOrgEx

user32

AdjustWindowRectEx CallMsgFilterW ClientToScreen CopyRect CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawEdge DrawIconEx DrawTextW EnableScrollBar EnumChildWindows EnumWindows FillRect GetAncestor GetCapture GetClassLongA GetClassLongW GetClassNameW GetClientRect GetDC GetDCEx GetDesktopWindow GetFocus GetForegroundWindow GetMenu GetMenuState GetMessageW GetParent GetPropW GetScrollBarInfo GetScrollInfo GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetWindowInfo GetWindowLongW GetWindowRect GetWindowThreadProcessId HideCaret InflateRect InternalGetWindowText IsChild IsRectEmpty IsWindow KillSystemTimer LoadIconW LoadImageW LoadStringW MapWindowPoints OffsetRect PaintMenuBar PtInRect RegisterClassExW ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageA SendMessageTimeoutA SendMessageW SetCapture SetPropW SetRect SetScrollInfo SetSysColors SetSystemTimer SetWindowLongA SetWindowPos SetWindowTextW ShowCaret SystemParametersInfoA SystemParametersInfoW TrackMouseEvent TranslateMessage UnregisterClassW UnregisterUserApiHook wsprintfW

Name

.text

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

340B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

126KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

13f362a05e17583b9629ea804fefcbb0d44bd39c71143fa81bb4f76ee0f74885

ntdll

advapi32

kernel32

msvcrt

gdi32

user32

generic