f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1

Sharing

Copy URL Twitter E-mail

General

Target
f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1
Size 337KB
Sample260916-massvas14p
SHA256 f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1
MD5 708dd21517aa1756fd8369335a77272c
SHA1 698ed491384955bf710a85366c512144ee55b65b
SHA512 ffd54e1d5ae1082b2dbad1feab49e1d07b2e1e4f50fd86bd9df7ffe9b023e2508a0edfc6f852f9e3bf1df32a43b9703a11fa48d1a58f65ff576910efe7fb7992
SSDEEP 3072:DjJaeaDkYTifjjCIDJ6Hp2nCY+vJpjURKzfUx1sckF6L47jetttvG5SmXf43k:XJaZDkVjjTnCnh1zfUL6Xf40
TLSH
T16474185BEECF6D26EEF567794A7717584A32FCA04931880F8705B03A01329974EE7722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1

File Explorer

f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1

.exe 337KB

f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1

IMPHASH a10860c7bd6ff91d07be8903a66965b9
SHA256 f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1
MD5 708dd21517aa1756fd8369335a77272c
SHA1 698ed491384955bf710a85366c512144ee55b65b
SHA512 ffd54e1d5ae1082b2dbad1feab49e1d07b2e1e4f50fd86bd9df7ffe9b023e2508a0edfc6f852f9e3bf1df32a43b9703a11fa48d1a58f65ff576910efe7fb7992
SSDEEP 3072:DjJaeaDkYTifjjCIDJ6Hp2nCY+vJpjURKzfUx1sckF6L47jetttvG5SmXf43k:XJaZDkVjjTnCnh1zfUL6Xf40
TLSH
T16474185BEECF6D26EEF567794A7717584A32FCA04931880F8705B03A01329974EE7722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25533

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtSetDefaultLocale vDbgPrintExWithPrefix

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CreateProcessW DeleteCriticalSection EnterCriticalSection EnumSystemLocalesW ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetFileAttributesW GetLastError GetLocaleInfoW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetStartupInfoW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTickCount GetUserDefaultLCID GetWindowsDirectoryW HeapAlloc HeapFree InitializeCriticalSection IsValidLocale LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocalReAlloc QueryPerformanceCounter SetLastError SetThreadLocale SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf _wcmdln _wcsicmp abort bsearch calloc exit free fwrite malloc memcmp memmove signal sprintf strchr strcmp strcpy strcspn strncmp vfprintf swprintf wcschr wcscpy wcslen wcsrchr wcstol wcstoul

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock GetUserProfileDirectoryW

gdi32

CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject GdiAlphaBlend GetObjectW GetPixel SelectObject

user32

DialogBoxParamW EnableWindow EndDialog ExitWindowsEx GetDC GetDesktopWindow GetDlgItem GetKeyState GetKeyboardLayoutNameW GetParent GetWindowLongW GetWindowRect LoadImageW LoadKeyboardLayoutW LoadStringW MessageBoxW ReleaseDC SendDlgItemMessageW SendMessageW SetSysColors SetWindowLongW SetWindowPos SystemParametersInfoW UpdatePerUserSystemParameters

Name

.text

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f45c68f3827d9970b5b4aa0968fd04aaeb106e33e7001c7b88a5cda9301902c1

ntdll

advapi32

kernel32

msvcrt

userenv

gdi32

user32

generic