05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f

General

Target
05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f
Size 192KB
Sample260916-wqdtasstdv
SHA256 05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f
MD5 a186b59c6ebcae78f383803be2ab2438
SHA1 54c54db79eb23b5641e66b6d0c81e52108b57ce0
SHA512 133efc478195971ab71a152af840cd4b65e9d8af021a2fad5a7a557174f0abd441f3fc7d18eb5542f4c5b1af57a5272dac2e127e8f0afd2041fdd3efb4f38a55
SSDEEP 3072:gMUR977NG+VIIZMXJz1YUb6HUmi07qG/66hz965sPfL64GF:gMm77znMXJz1YUby2A8gz64
TLSH
T185144910BBC265B0E49106781EBDD21F6B24AB12E7A2AFEB4F110DA54F9D0F1B33D546
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f

File Explorer

05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f

.dll 192KB

05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f

IMPHASH 36477f2a79a2986de5f8662410bee9be
SHA256 05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f
MD5 a186b59c6ebcae78f383803be2ab2438
SHA1 54c54db79eb23b5641e66b6d0c81e52108b57ce0
SHA512 133efc478195971ab71a152af840cd4b65e9d8af021a2fad5a7a557174f0abd441f3fc7d18eb5542f4c5b1af57a5272dac2e127e8f0afd2041fdd3efb4f38a55
SSDEEP 3072:gMUR977NG+VIIZMXJz1YUb6HUmi07qG/66hz965sPfL64GF:gMm77znMXJz1YUby2A8gz64
TLSH
T185144910BBC265B0E49106781EBDD21F6B24AB12E7A2AFEB4F110DA54F9D0F1B33D546
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

92400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

timeGetTime

ole32

CLSIDFromString

user32

GetMessageW wsprintfA

advapi32

RegCloseKey RegEnumKeyExA RegGetValueA RegGetValueW RegOpenKeyExA RegQueryValueExA

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswscanf _strdup calloc free fwrite getenv malloc memcpy memmove memset strcat strchr strcmp strcpy strcspn strlen wcslen wcsnlen

kernel32

CloseHandle CreateEventW CreateFileMappingA CreateProcessA CreateSemaphoreA CreateThread DebugBreak DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection EnumResourceNamesW FindResourceW FlushViewOfFile FreeLibrary GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeCriticalSectionEx IsBadStringPtrA LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource MapViewOfFile MapViewOfFileEx MultiByteToWideChar ReleaseSemaphore ResumeThread SetEvent SizeofResource SleepEx TerminateThread UnmapViewOfFile WaitForSingleObject WideCharToMultiByte

ntdll

_vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

05a61dca65f94abae3fb9dcb275bf8a2f6c402ce0a9f2327f857f1e0bd82674f

winmm

ole32

user32

advapi32

ucrtbase

kernel32

ntdll

generic