c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d

Sharing

Copy URL Twitter E-mail

General

Target
c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d
Size 397KB
Sample260919-xq2e2aah99
SHA256 c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d
MD5 77652a3bcf6d8e8a331e1e9e50daa653
SHA1 78ee391ed1f1e348ac263d7c6cf50da181795250
SHA512 f2a1a900611400dac7d34155093bc290a6f4579156dd1eb0ac5eab10f1619d6c463686788e47360180e10503226eda8d57625b589b0a5bc474612115fa829cac
SSDEEP 12288:gTBeckkH2oYCQhYz5J5FdxoHwDKZ5QpAOxjQFJV:gTBeckkH2oYCQhYz5J5FdxoHwDKZ5QpI
TLSH
T1CC84A541A7E59F9EF0B22BB048B687E50535FE94A830C94FBBD0774D1873A00D7A6726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d

File Explorer

c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d

.exe 397KB

c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d

IMPHASH febefcd3336f115f6db7070df6b7323e
SHA256 c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d
MD5 77652a3bcf6d8e8a331e1e9e50daa653
SHA1 78ee391ed1f1e348ac263d7c6cf50da181795250
SHA512 f2a1a900611400dac7d34155093bc290a6f4579156dd1eb0ac5eab10f1619d6c463686788e47360180e10503226eda8d57625b589b0a5bc474612115fa829cac
SSDEEP 12288:gTBeckkH2oYCQhYz5J5FdxoHwDKZ5QpAOxjQFJV:gTBeckkH2oYCQhYz5J5FdxoHwDKZ5QpI
TLSH
T1CC84A541A7E59F9EF0B22BB048B687E50535FE94A830C94FBBD0774D1873A00D7A6726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54169

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

BackupEventLogW ClearEventLogW CloseEventLog ConvertSidToStringSidW EqualSid GetNumberOfEventLogRecords IsValidSid LookupAccountSidW OpenBackupEventLogW OpenEventLogW ReadEventLogW RegCloseKey RegConnectRegistryW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx PropertySheetW

comdlg32

GetOpenFileNameW GetSaveFileNameW

kernel32

CloseHandle CreateEventW CreateThread DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FormatMessageW FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetFileAttributesExW GetLastError GetLocaleInfoW GetModuleHandleA GetNumberFormatW GetProcAddress GetProcessHeap GetStartupInfoW GetStringTypeW GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MulDiv QueryPerformanceCounter ResumeThread RtlUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _assert _cexit _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsicmp _wtoi _wtol abort calloc exit free fwrite iswctype malloc memmove memset signal strncmp swprintf swscanf towupper vfprintf wcschr wcscpy wcslen wcsncpy wcsstr wcstok

shell32

CommandLineToArgvW ShellAboutW ShellExecuteW

shlwapi

StrFormatByteSizeW

gdi32

CreateFontIndirectW DeleteObject GetDeviceCaps

user32

BeginDeferWindowPos CheckMenuItem CheckMenuRadioItem CheckRadioButton CloseClipboard CreateDialogParamW CreateWindowExW DefWindowProcW DeferWindowPos DestroyWindow DialogBoxParamW DispatchMessageW EmptyClipboard EnableMenuItem EnableWindow EndDeferWindowPos EndDialog GetCapture GetClientRect GetCursorPos GetDC GetDlgItem GetDlgItemInt GetDlgItemTextW GetFocus GetKeyState GetMenu GetMessageW GetParent GetScrollInfo GetSubMenu GetSysColor GetSystemMetrics GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW InvalidateRect IsDlgButtonChecked IsWindow IsWindowVisible LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW MapWindowPoints MessageBoxW MoveWindow OpenClipboard PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient ScrollWindowEx SendDlgItemMessageW SendMessageW SetCapture SetClipboardData SetCursor SetDlgItemInt SetDlgItemTextW SetFocus SetRect SetScrollInfo SetWindowLongW SetWindowPos SetWindowTextW ShowScrollBar ShowWindow TrackPopupMenuEx TranslateAcceleratorW TranslateMessage UpdateWindow

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

241KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c2dff5d9b36990602636991be725a4bc1cb384d7c77af6d64dc59f7911de611d

advapi32

comctl32

comdlg32

kernel32

msvcrt

shell32

shlwapi

gdi32

user32

generic