4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6

Sharing

Copy URL Twitter E-mail

General

Target
4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6
Size 85KB
Sample260919-xnpy8aah65
SHA256 4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6
MD5 920349d2574fa26136ef7df0a50b2242
SHA1 f228682aa16dd043f0c67a4d2cbb0950ee3a7f9b
SHA512 1760b7432b2f640f5f7ba78a289c6bbfaef75cefc3913285a7ae1b4ad5211cbd7a6e19d27bc78603bdf30e171b74ae9de142d1d9be25ae7c9bc8f3d91aa32ae3
SSDEEP 1536:DYmEgNSnCgKUvpUYtORpagHVS3cz94y+sAPc:DtDNVQREAg1S3I9DK
TLSH
T12783F906DAD6EE67EA7D17B0ACAA47994B39FF009F13CF0F5B54224E19317016AE4312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6

File Explorer

4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6

.exe 85KB

4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6

IMPHASH 8944ecf4acc029e2fc22930a49179ddc
SHA256 4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6
MD5 920349d2574fa26136ef7df0a50b2242
SHA1 f228682aa16dd043f0c67a4d2cbb0950ee3a7f9b
SHA512 1760b7432b2f640f5f7ba78a289c6bbfaef75cefc3913285a7ae1b4ad5211cbd7a6e19d27bc78603bdf30e171b74ae9de142d1d9be25ae7c9bc8f3d91aa32ae3
SSDEEP 1536:DYmEgNSnCgKUvpUYtORpagHVS3cz94y+sAPc:DtDNVQREAg1S3I9DK
TLSH
T12783F906DAD6EE67EA7D17B0ACAA47994B39FF009F13CF0F5B54224E19317016AE4312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

DbgPrint

comctl32

InitCommonControls

comdlg32

GetSaveFileNameW

kernel32

DeleteCriticalSection EnterCriticalSection FindResourceW FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LockResource QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _unlock _wcmdln abort calloc exit free fwrite malloc memmove signal strncmp vfprintf wcscpy wcslen

shell32

ShellAboutW

user32

CreateWindowExW DefFrameProcW DefMDIChildProcW DestroyMenu DestroyWindow DispatchMessageW GetClientRect GetMessageW GetSubMenu GetWindowLongW GetWindowTextW LoadCursorW LoadIconW LoadMenuW LoadStringW PostMessageW PostQuitMessage RegisterClassExW SendMessageW SetMenu SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TranslateMDISysAccel TranslateMessage UnregisterClassW

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1024B

Virtual Size

708B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1012B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4a407f19c481ca7fe594d1ebe8454b4cb51a8187a610acde7b571eb890bc54a6

ntdll

comctl32

comdlg32

kernel32

msvcrt

shell32

user32

generic