0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3

Sharing

Copy URL Twitter E-mail

General

Target
0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3
Size 343KB
Sample260916-mjf6eayfna
SHA256 0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3
MD5 1fe797d4b21ab0cb9ae3c11785fedf1c
SHA1 0c88c309d6daa6627b4d721b85b9c11d7e1c4b15
SHA512 1cbf2666a29d1552eac17e74e00550bb2cf14a3ef5721877ca7bbf2de388be80a9e9edc4a461cd30e8a1c2f6f3327b9a403332fb0d766eedfc14f33d80bb0ed8
SSDEEP 3072:Nmn5O2/nTSzCQBS794V91KeBCSBssxxVssssS0cDeB6spTt81zAmb/7dN+5T2PkP:AnnnXpq94PRd8l6oL
TLSH
T1EE749500D7FE8A06F5F35B716DB243911A3AFC24AB31CB0FB749654E2931A509E65B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3

File Explorer

0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3

.exe 343KB

0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3

IMPHASH 1e1004a7c83c96f878a710886280e671
SHA256 0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3
MD5 1fe797d4b21ab0cb9ae3c11785fedf1c
SHA1 0c88c309d6daa6627b4d721b85b9c11d7e1c4b15
SHA512 1cbf2666a29d1552eac17e74e00550bb2cf14a3ef5721877ca7bbf2de388be80a9e9edc4a461cd30e8a1c2f6f3327b9a403332fb0d766eedfc14f33d80bb0ed8
SSDEEP 3072:Nmn5O2/nTSzCQBS794V91KeBCSBssxxVssssS0cDeB6spTt81zAmb/7dN+5T2PkP:AnnnXpq94PRd8l6oL
TLSH
T1EE749500D7FE8A06F5F35B716DB243911A3AFC24AB31CB0FB749654E2931A509E65B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31597

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

IsTextUnicode RegCloseKey RegCreateKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

CreateStatusWindowW

comdlg32

ChooseFontW FindTextW GetFileTitleW GetOpenFileNameW GetSaveFileNameW PageSetupDlgW PrintDlgW ReplaceTextW

kernel32

CloseHandle CreateFileMappingW CreateFileW CreateThread DeleteCriticalSection EnterCriticalSection FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetUserDefaultLangID GetUserDefaultUILanguage GlobalFree HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalLock LocalUnlock MapViewOfFile MulDiv MultiByteToWideChar QueryPerformanceCounter SetEndOfFile SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WideCharToMultiByte WriteFile lstrlenW

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _assert _cexit _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsnicmp abort calloc exit free fwrite iswctype malloc memcpy memmove memset signal strncmp towupper vfprintf wcscat wcscmp wcscpy wcslen wcsncmp wcsncpy wcsrchr

shell32

DragAcceptFiles DragFinish DragQueryFileW SHAddToRecentDocs ShellAboutW ShellExecuteW

gdi32

AbortDoc CreateFontIndirectW DeleteDC DeleteObject EndDoc EndPage GetDeviceCaps GetStockObject GetTextExtentPoint32W GetTextMetricsW Rectangle SelectObject SetMapMode StartDocW StartPage TextOutW

user32

CallWindowProcW CheckMenuItem CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EnableMenuItem EnableWindow EndDialog GetClientRect GetDC GetDlgItem GetDlgItemInt GetDlgItemTextW GetMenu GetMessageW GetSystemMetrics GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InflateRect InvalidateRect IsClipboardFormatAvailable IsDialogMessageW LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxW MoveWindow PostMessageW PostQuitMessage RegisterClassExW RegisterWindowMessageW ReleaseDC SendDlgItemMessageW SendMessageW SetCursor SetDlgItemInt SetDlgItemTextW SetFocus SetProcessDefaultLayout SetRect SetWindowLongW SetWindowPlacement SetWindowTextW ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow WinHelpW wsprintfW

Name

.text

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0ebadb66abbfc1d6ed9c88f0f5936da5a7d8ebe3709717f29a99469c0be786b3

advapi32

comctl32

comdlg32

kernel32

msvcrt

shell32

gdi32

user32

generic