6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4

Sharing

Copy URL Twitter E-mail

General

Target
6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4
Size 4.7MB
Sample260916-mlvrksts8j
SHA256 6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4
MD5 071b07e163c984f5e384ed3df367d2cc
SHA1 00abb910538c8b117bbee310613e44d4801e6736
SHA512 19e2c5e130d90a5f050ac65df66c2ae23580e8d776fd36c3402ad2c36977ad53aacd975671bc13af7b816967428f17994b3e2a37e6d61d6215bc1744a3cec0fc
SSDEEP 98304:PeBbo4gAb57++9gJf6PD3NmZ7AJEgLYXLKUCCCNYzQEr0WO0Yk84INUtD1+fm05i:54tx+VJiPD3NmlAJEgLYX5CNYzQEr0Wl
TLSH
T14236AE317DACA119D157E4F8B05FC3F8C9099A2043FD0ADD2134BE6056ABFA67344DAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4

File Explorer

6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4

.exe 4.7MB

6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4

IMPHASH c131d435a7aedf888c0eb586df07bfda
SHA256 6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4
MD5 071b07e163c984f5e384ed3df367d2cc
SHA1 00abb910538c8b117bbee310613e44d4801e6736
SHA512 19e2c5e130d90a5f050ac65df66c2ae23580e8d776fd36c3402ad2c36977ad53aacd975671bc13af7b816967428f17994b3e2a37e6d61d6215bc1744a3cec0fc
SSDEEP 98304:PeBbo4gAb57++9gJf6PD3NmZ7AJEgLYXLKUCCCNYzQEr0WO0Yk84INUtD1+fm05i:54tx+VJiPD3NmlAJEgLYX5CNYzQEr0Wl
TLSH
T14236AE317DACA119D157E4F8B05FC3F8C9099A2043FD0ADD2134BE6056ABFA67344DAA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

135050

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatA lstrlenA Sleep GetFileSize ReadFile SetFilePointer GetModuleHandleA FreeLibrary MultiByteToWideChar CopyFileA GetSystemTime FindClose FindNextFileA FindFirstFileA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA GetSystemDefaultLangID lstrcpyW lstrlenW CreateProcessA MoveFileA ExpandEnvironmentStringsA GetWindowsDirectoryW InitializeCriticalSection DuplicateHandle TerminateThread OpenProcess IsBadReadPtr SetLastError GetVersionExA WaitForSingleObject ResumeThread SetThreadContext GetThreadContext CreateEventA SuspendThread GetLastError SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA SetStdHandle GetOEMCP GetACP GetCPInfo IsBadCodePtr InterlockedIncrement InterlockedDecrement SetUnhandledExceptionFilter GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection IsBadWritePtr HeapCreate HeapDestroy GetEnvironmentVariableA HeapSize HeapReAlloc UnhandledExceptionFilter HeapAlloc TlsAlloc GetCurrentThreadId RaiseException ExitProcess GetVersion UnmapViewOfFile LoadLibraryA GetProcAddress CreateFileA WriteFile GetCurrentDirectoryA OpenFileMappingA GetCurrentProcessId GetSystemDirectoryA SetFileAttributesA GetModuleFileNameA VirtualProtect VirtualAlloc WinExec CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next CloseHandle GetCurrentProcess TerminateProcess DeleteFileA GetCommandLineA GetStartupInfoA HeapFree RtlUnwind GetLocalTime GetTimeZoneInformation ExitThread TlsGetValue TlsSetValue CreateThread VirtualFree lstrcpyA CreateFileMappingA MapViewOfFile

user32

EndDialog SetTimer MessageBoxA SystemParametersInfoA IsDlgButtonChecked GetWindow GetClassNameA IsWindow GetTopWindow IsWindowVisible FindWindowA wsprintfA KillTimer LoadIconA GetDlgItem CheckDlgButton EnableWindow SetDlgItemTextA GetDlgItemTextA GetClassNameW GetWindowThreadProcessId GetKeyboardLayoutNameA GetKeyboardLayoutList UnloadKeyboardLayout ReleaseCapture ClientToScreen SetCursor SetCapture LoadBitmapA LoadCursorA WindowFromPoint GetParent PtInRect GetWindowDC GetWindowRect OffsetRect IsRectEmpty ReleaseDC DialogBoxParamA GetClassInfoExA RegisterClassExA WaitForInputIdle SendMessageA PeekMessageA TranslateMessage DispatchMessageA PostMessageA

gdi32

PatBlt

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegEnumKeyExA RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegOpenKeyA RegEnumValueA

shell32

ShellExecuteExA ShellExecuteA

ws2_32

inet_addr htons connect send select closesocket socket inet_ntoa gethostbyname WSAStartup recv __WSAFDIsSet

imm32

ImmGetDescriptionA ImmIsIME

shlwapi

PathFindExtensionA PathRemoveFileSpecA PathFileExistsA PathIsFileSpecA PathFindFileNameA StrCatW PathRenameExtensionA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text0

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text1

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6fd23d8c9b561684bd260f493684472c0f0ee6eec26e7da72c4bd1634d88fdc4

kernel32

user32

gdi32

advapi32

shell32

ws2_32

imm32

shlwapi

version

generic