94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1

Sharing

Copy URL Twitter E-mail

General

Target
94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1
Size 113KB
Sample260916-s8783ssela
SHA256 94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1
MD5 861756895a9bbabf939c883c699df296
SHA1 1f8f75ed53f637d49d06f8085a98b58759f52150
SHA512 c725ac0187bbae2f4885194c1cc040c86787d3be95a5161fb9f9326fc7fa2df31649fa4e24d204623f9c124314347b9fb77de40b900edd53308d5896a01dd228
SSDEEP 1536:gE3FDwv/Jep1QRHZ3+uagiSz7vi8idtEmR56mzRZICrWaGZh7K:gyFDwEp45JWSFidtEmRQGJrWNZ4
TLSH
T15CB38D117360D432D05215308976D3B29A79BC726B7885C777D81EEFAE703C1EA3A36A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1

File Explorer

94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1

.exe 113KB

94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1

IMPHASH 342a3708d93b6b819b7b1a768201a747
SHA256 94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1
MD5 861756895a9bbabf939c883c699df296
SHA1 1f8f75ed53f637d49d06f8085a98b58759f52150
SHA512 c725ac0187bbae2f4885194c1cc040c86787d3be95a5161fb9f9326fc7fa2df31649fa4e24d204623f9c124314347b9fb77de40b900edd53308d5896a01dd228
SSDEEP 1536:gE3FDwv/Jep1QRHZ3+uagiSz7vi8idtEmR56mzRZICrWaGZh7K:gyFDwEp45JWSFidtEmRQGJrWNZ4
TLSH
T15CB38D117360D432D05215308976D3B29A79BC726B7885C777D81EEFAE703C1EA3A36A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13601

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

gethostbyname WSAGetLastError gethostname connect WSAStartup send htons WSACleanup recv socket closesocket

wininet

DeleteUrlCacheEntry

advapi32

RegOpenKeyA GetUserNameA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

urlmon

URLOpenBlockingStreamA

kernel32

HeapSize IsProcessorFeaturePresent RtlUnwind SetStdHandle WriteConsoleW CreateFileW FlushFileBuffers CompareStringW SetEnvironmentVariableA IsDebuggerPresent GetStringTypeW ExitProcess CreateFileA GetFileSize PeekNamedPipe HeapAlloc HeapFree WaitForSingleObject GetTickCount GetProcessHeap WriteFile GetCommandLineA GlobalAlloc Sleep GetExitCodeProcess CreateProcessA ReadFile lstrcatA CreateDirectoryA SetCurrentDirectoryA GetLastError OpenMutexA CreatePipe GetModuleFileNameA CreateMutexA GetVersionExA WinExec CloseHandle GetTempPathA lstrcpyA HeapReAlloc GetSystemTimeAsFileTime HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter DecodePointer EncodePointer GetProcAddress GetModuleHandleW GetStdHandle GetModuleFileNameW HeapCreate GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId WideCharToMultiByte LCMapStringW MultiByteToWideChar GetTimeZoneInformation RaiseException FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetCurrentProcessId SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection LoadLibraryW

Sharing

General

Malware Config

Signatures

File Explorer

94d20688f0beb6f4f5dd0937f12dcbc551ece83f3b7e93daea9abd54363085d1

ws2_32

wininet

advapi32

urlmon

kernel32

generic