0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538

Sharing

Copy URL Twitter E-mail

General

Target
0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538
Size 6.2MB
Sample260916-xdjpfsthmb
SHA256 0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538
MD5 78a11ebe1f6148d62f5c1b1cca8120a0
SHA1 48d18fa8229a0b9101a5389c95b3db8b43283cfc
SHA512 83ae9ad4bde0c8100330a23e115921768d393f961908a0b36e9212864730350c654c192c37ce1a83554ba90ce977a6d23608d336ef18a1e3ae26f7384d6bcfdf
SSDEEP 98304:g9PzJhvkcQ+v49pN/hwQqZUha5jtSyZIUbm:ATvkcQmIiQbaZtlir
TLSH
T16A66AE05EBA8EE2EC91F0375A4B2211197F5C5D4D783EBE2AD11F4B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538

File Explorer

0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538

.exe 6.2MB

0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538

IMPHASH 2847d22fec522c8926da88a0a3543ac1
SHA256 0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538
MD5 78a11ebe1f6148d62f5c1b1cca8120a0
SHA1 48d18fa8229a0b9101a5389c95b3db8b43283cfc
SHA512 83ae9ad4bde0c8100330a23e115921768d393f961908a0b36e9212864730350c654c192c37ce1a83554ba90ce977a6d23608d336ef18a1e3ae26f7384d6bcfdf
SSDEEP 98304:g9PzJhvkcQ+v49pN/hwQqZUha5jtSyZIUbm:ATvkcQmIiQbaZtlir
TLSH
T16A66AE05EBA8EE2EC91F0375A4B2211197F5C5D4D783EBE2AD11F4B8BD833507A06297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130117

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError CloseHandle InitializeCriticalSectionAndSpinCount WideCharToMultiByte MoveFileW DeleteFileW SetFileAttributesW GetTempPathW GetTempFileNameW MoveFileExW CreateFileW GetFileSize WriteFile GetComputerNameA GetModuleFileNameW CreateProcessW Sleep GetSystemTime FileTimeToLocalFileTime RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess GetModuleHandleA FindResourceExW FindResourceW LoadResource LockResource SizeofResource FileTimeToSystemTime SystemTimeToFileTime GetComputerNameW LoadLibraryW GetProcAddress ReadFile GetModuleHandleW SetEndOfFile WriteConsoleW SetStdHandle ReadConsoleW OutputDebugStringW SetFilePointer FlushFileBuffers SetFilePointerEx InterlockedIncrement InterlockedDecrement MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer GetCommandLineW GetCurrentThreadId LoadLibraryExW RtlUnwind GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW IsProcessorFeaturePresent LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW GetStdHandle GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsDebuggerPresent GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetOEMCP

advapi32

CreateServiceW RegCreateKeyExW CloseServiceHandle StartServiceW ChangeServiceConfigW QueryServiceConfigW OpenServiceW OpenSCManagerW RegSetValueExW RegOpenKeyExW RegCloseKey CryptReleaseContext CryptAcquireContextW GetUserNameW GetUserNameA FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExW

ole32

CoCreateInstance CoInitialize

shell32

ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathIsRootW PathAddExtensionW PathRemoveExtensionW PathAppendW PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer

0a55bf6f29811f0534118f0fcc143967038a13bc8caa14b417265a5adeb53538

kernel32

advapi32

ole32

shell32

shlwapi

generic