07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869

Sharing

Copy URL Twitter E-mail

General

Target
07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869
Size 1.5MB
Sample260916-wzj2nstepa
SHA256 07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869
MD5 bb43e0fafcfb88fe64b0e6d691f04ff1
SHA1 16a0e90a7eb8dc9fc9722704f41ea55556f58675
SHA512 0a9925763cacfacb03110105f2612a5274e1968ab7ddeb0c86f04f16cc5182961e6a23a31ae921cb84ebe3b8a9b9e1b9ccb5ddf48f2569ac83fecbfd18620957
SSDEEP 24576:vcvagMar1PcYc89inxLs3EL05q2Z/IrCFFZ:vVarh7P9inm4uLZOkZ
TLSH
T1E165E006B3A848E9E97B923C8D928505E7B2BC654B70D7CF6364471E2F33AD09E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869

File Explorer

07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869

.exe 1.5MB

07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869

IMPHASH cf5b162c2c5d6f1d1fb3b218feb1b648
SHA256 07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869
MD5 bb43e0fafcfb88fe64b0e6d691f04ff1
SHA1 16a0e90a7eb8dc9fc9722704f41ea55556f58675
SHA512 0a9925763cacfacb03110105f2612a5274e1968ab7ddeb0c86f04f16cc5182961e6a23a31ae921cb84ebe3b8a9b9e1b9ccb5ddf48f2569ac83fecbfd18620957
SSDEEP 24576:vcvagMar1PcYc89inxLs3EL05q2Z/IrCFFZ:vVarh7P9inm4uLZOkZ
TLSH
T1E165E006B3A848E9E97B923C8D928505E7B2BC654B70D7CF6364471E2F33AD09E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OutputDebugStringW SetEndOfFile CreateFileW WriteConsoleW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW IsDebuggerPresent WTSGetActiveConsoleSessionId GetSystemDirectoryW CreateProcessW MultiByteToWideChar FindResourceW lstrcmpiW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetCurrentThreadId GetCurrentThread CreateThread GetCurrentProcess Sleep CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc RaiseException CloseHandle DecodePointer GetCommandLineW GlobalFree GlobalUnlock LCMapStringW GetOEMCP GetACP IsValidCodePage SetFilePointerEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FreeEnvironmentStringsW GetEnvironmentStringsW GlobalLock GlobalAlloc SetLastError GetLastError GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WriteFile GetStartupInfoW GetFileType GetStdHandle WideCharToMultiByte GetModuleHandleExW LocalFree RtlLookupFunctionEntry RtlUnwindEx EncodePointer IsProcessorFeaturePresent RtlPcToFileHeader GetCPInfo DeleteFileW ExitProcess

user32

CharUpperW PostThreadMessageW CharNextW MessageBoxW GetMessageW LoadStringW TranslateMessage DispatchMessageW

advapi32

DeregisterEventSource OpenThreadToken CopySid GetLengthSid StartServiceW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey ReportEventW RegisterEventSourceW GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSid InitializeSecurityDescriptor OpenProcessToken

ole32

CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc PropVariantClear CoSetProxyBlanket CoTaskMemFree StringFromGUID2

oleaut32

VarUI4FromStr SysAllocString SysFreeString SysStringLen LoadTypeLi LoadRegTypeLi RegisterTypeLi SysAllocStringByteLen VarBstrCat SysAllocStringLen UnRegisterTypeLi

shlwapi

PathFileExistsW

gdi32

D3DKMTCloseAdapter D3DKMTEscape D3DKMTOpenAdapterFromDeviceName

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

07c719aee43c337c2b4a74f19d6734d549a72750c4060c1d67f8210fb2748869

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

gdi32

setupapi

userenv

wtsapi32

generic