8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2

Sharing

Copy URL Twitter E-mail

General

Target
8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2
Size 161KB
Sample260916-rhg4jaztev
SHA256 8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2
MD5 ca6598b88bf5c7a6f96d8019f7209efb
SHA1 7d7a7d7d5a09c74aa56d4327d7f142fdb8b9062e
SHA512 e2f4f86531afd8e059e705beb5185b5584cfb817e2ae3565be4e1fb7630510e3bd73ea6146458a9ebc8baf857605afcc820222ddd8d816b3de90b09aa85a43b5
SSDEEP 1536:TFs+dOG00IZv56vAaLDdw5Mg0rplXjHtIe46U+GuSawW8MDimCA9XgGQSMKNli7W:CUu5AV9XzF4R+iA9aI6Ks2pWqSPSlRF
TLSH
T150F37C1716D4F032E39312348A69E2F26A7D763549C5DA0BAB90432A39713D3E7B970F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2

File Explorer

8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2

.exe 161KB

8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2

IMPHASH a8ffa8f05204dbd831484a4120599c72
SHA256 8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2
MD5 ca6598b88bf5c7a6f96d8019f7209efb
SHA1 7d7a7d7d5a09c74aa56d4327d7f142fdb8b9062e
SHA512 e2f4f86531afd8e059e705beb5185b5584cfb817e2ae3565be4e1fb7630510e3bd73ea6146458a9ebc8baf857605afcc820222ddd8d816b3de90b09aa85a43b5
SSDEEP 1536:TFs+dOG00IZv56vAaLDdw5Mg0rplXjHtIe46U+GuSawW8MDimCA9XgGQSMKNli7W:CUu5AV9XzF4R+iA9aI6Ks2pWqSPSlRF
TLSH
T150F37C1716D4F032E39312348A69E2F26A7D763549C5DA0BAB90432A39713D3E7B970F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69458

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

P:\Target\x86\ship\delivery\x-none\ose.pdb

advapi32

RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW SetThreadToken RegEnumValueW RegQueryValueExW RegSetValueExW RegNotifyChangeKeyValue SetServiceStatus StartServiceCtrlDispatcherW DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AllocateAndInitializeSid CheckTokenMembership FreeSid LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken SetFileSecurityW RegDeleteKeyW CryptAcquireContextW CryptReleaseContext

kernel32

CloseHandle GetLastError SetEvent GetModuleFileNameW GetDriveTypeW GetLogicalDrives lstrcmpW lstrlenW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep ExitProcess GetCommandLineW SetErrorMode ResetEvent ReleaseMutex WaitForMultipleObjectsEx CreateMutexW CreateEventW CreateProcessW GetSystemInfo GetTickCount MoveFileExW CreateFileA CreateFileW ReadFile SetFilePointer FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW DosDateTimeToFileTime MultiByteToWideChar WideCharToMultiByte ReleaseSemaphore WaitForSingleObject CreateThread WaitForMultipleObjects CreateSemaphoreW SetFilePointerEx VirtualAlloc VirtualFree GlobalAlloc GlobalFree GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareStringW SetEndOfFile SetFileTime WriteFile GetSystemTime SystemTimeToFileTime GetCommandLineA HeapSetInformation GetStartupInfoW DecodePointer EncodePointer SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate QueryPerformanceCounter GetCurrentProcessId TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapAlloc RaiseException HeapFree IsProcessorFeaturePresent InterlockedExchange LoadLibraryW GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind HeapSize LCMapStringW GetStringTypeW HeapReAlloc LocalFree SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FindClose FindFirstFileW GetFileSizeEx CreateDirectoryW GetFileAttributesW GetTempPathW DeleteFileW FindNextFileW GetFileAttributesExW GetFileTime SetFileAttributesW GetTempPathA CopyFileW CreateHardLinkW RemoveDirectoryW FormatMessageA lstrlenA GetComputerNameW GetProcessHeap FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP LoadLibraryA LocalAlloc

rpcrt4

RpcRevertToSelf RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqEpW RpcImpersonateClient NdrServerCall2

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

8a249d8115992619513055e2e6a7257368295b7e6ca5cdbe79c2ead61b90b3a2

advapi32

kernel32

rpcrt4

version

wintrust

generic