057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca

Sharing

Copy URL Twitter E-mail

General

Target
057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca
Size 3.4MB
Sample260919-jmh8dsx1ds
SHA256 057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca
MD5 fe81e7dda9331b24df26802b35be763b
SHA1 6426b609822e42d7fd8e800a5636d96979388e63
SHA512 e780547fd41edcd03b0f866ccdbaab45d129c88364f206fa2729f2738903da2511ddf3cc9eb28d31ffb419244d278d27cb35ac39a40e317ecbaefc3bf9fd0920
SSDEEP 49152:jsgFI9k3HeErb/TLvO90d7HjmAFd4A64nsfJUU3fPb1MHbHGjLAi2PhhWq/U1IWN:j93HQ48p
TLSH
T1ACF5AEC3BC51E664C5AA92319850E5967A717C0C1F3323EB6701BFBE6E7A7C04A39358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca

File Explorer

057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca

.dll 3.4MB

057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca

IMPHASH da7f8acb6151c95be088a02465d68ef8
SHA256 057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca
MD5 fe81e7dda9331b24df26802b35be763b
SHA1 6426b609822e42d7fd8e800a5636d96979388e63
SHA512 e780547fd41edcd03b0f866ccdbaab45d129c88364f206fa2729f2738903da2511ddf3cc9eb28d31ffb419244d278d27cb35ac39a40e317ecbaefc3bf9fd0920
SSDEEP 49152:jsgFI9k3HeErb/TLvO90d7HjmAFd4A64nsfJUU3fPb1MHbHGjLAi2PhhWq/U1IWN:j93HQ48p
TLSH
T1ACF5AEC3BC51E664C5AA92319850E5967A717C0C1F3323EB6701BFBE6E7A7C04A39358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateIoCompletionPort CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW GetConsoleMode GetEnvironmentStringsW GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar PostQueuedCompletionStatus ResumeThread SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _beginthread _errno _initterm _lock _unlock abort calloc fputc free fwrite localeconv malloc memcpy memset realloc strerror strlen strncmp vfprintf wcslen

Name

.text

Size

876KB

Virtual Size

876KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

057bd6481726e4d13ade8b4033161bd843cc9b73c8c9a3d899047a255fcc4dca

kernel32

msvcrt

generic