047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec

General

Target
047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec
Size 356KB
Sample260916-wjrftassft
SHA256 047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec
MD5 d08e070a6ee70124812bc9e2aa979d5d
SHA1 827348d6cb878d5c35c44d51814ab2145c91a59c
SHA512 ce29dfce7586cd95d1b2f0e47f35e3f6e767f2f4dea513df187497505b9508886e4853a85994afabf6592d3acb066d161cb57d7c60846aaa8c516f8db4730ec0
SSDEEP 6144:DVX6t4JL4+kQhPe71JaYG5VwYNc/fCfpzYY6jzvmTGw46t1XbrGHOpC:DVXDc+ksPe7rQ3wYXFYXjL3o1XbaHO
TLSH
T101749D5A72E40CB4E9A7927CC9534A09E7B37C024B60D7CF03A046AB9F677E0953E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec

File Explorer

047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec

.dll 356KB

047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec

IMPHASH 44e948480ef6fadf25e8280c96519146
SHA256 047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec
MD5 d08e070a6ee70124812bc9e2aa979d5d
SHA1 827348d6cb878d5c35c44d51814ab2145c91a59c
SHA512 ce29dfce7586cd95d1b2f0e47f35e3f6e767f2f4dea513df187497505b9508886e4853a85994afabf6592d3acb066d161cb57d7c60846aaa8c516f8db4730ec0
SSDEEP 6144:DVX6t4JL4+kQhPe71JaYG5VwYNc/fCfpzYY6jzvmTGw46t1XbrGHOpC:DVXDc+ksPe7rQ3wYXFYXjL3o1XbaHO
TLSH
T101749D5A72E40CB4E9A7927CC9534A09E7B37C024B60D7CF03A046AB9F677E0953E761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57268

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ntdll

RtlUnwindEx NtGetContextThread RtlUnwind RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlAllocateHeap NtMapViewOfSection RtlCreateUnicodeString NtOpenSection NtQueryObject NtContinue RtlFreeHeap NtClose NtCreateSection RtlCompareUnicodeString

kernel32

GetSystemInfo WriteConsoleW HeapSize SetStdHandle HeapReAlloc GetProcessHeap FreeEnvironmentStringsW GetModuleHandleA GetCurrentProcess GetProcAddress ExitProcess GetModuleHandleW CheckRemoteDebuggerPresent RemoveVectoredExceptionHandler VirtualProtect CreateFileW CloseHandle LoadLibraryW AddVectoredExceptionHandler VirtualQuery GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW AreFileApisANSI GetLastError MultiByteToWideChar WideCharToMultiByte LoadLibraryExA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW GetFileSizeEx SetFilePointerEx GetStdHandle GetFileType FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

047c106075a29b7dd3421d67ae3144e4fe4cd86ad3f8332c388a0f25f57762ec

ntdll

kernel32

shell32

ole32

generic