d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847

General

Target
d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847
Size 503KB
Sample260920-3m3ftavwhy
SHA256 d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847
MD5 f6bd5628947c5e93ec4ea1affce690d8
SHA1 e90ffaf2541b6894cb074390560cde5f1e37a0ca
SHA512 0b16d57d16c7896ade360094f3a5f6e208e1d570a41cccc3449b790791ff7bf815307988f71a912b0944373549615db9415d0ea11a184cb1172dda8a33cc3786
SSDEEP 6144:dxOjmkp1s22eSgQV1apcqptGARaYsooOd1lcCS/36ycpZzg:dgNU+yI6a0AR1soow+CSf6yMG
TLSH
T1BDB48C00A7A0C039F1F752F44ABA93A9B53E7AA15B2451CF53D12AEE5B346E0DD3131B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847

File Explorer

d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847

.exe 503KB

d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847

IMPHASH c14fb83e6812e3d5bc69106771d695a2
SHA256 d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847
MD5 f6bd5628947c5e93ec4ea1affce690d8
SHA1 e90ffaf2541b6894cb074390560cde5f1e37a0ca
SHA512 0b16d57d16c7896ade360094f3a5f6e208e1d570a41cccc3449b790791ff7bf815307988f71a912b0944373549615db9415d0ea11a184cb1172dda8a33cc3786
SSDEEP 6144:dxOjmkp1s22eSgQV1apcqptGARaYsooOd1lcCS/36ycpZzg:dgNU+yI6a0AR1soow+CSf6yMG
TLSH
T1BDB48C00A7A0C039F1F752F44ABA93A9B53E7AA15B2451CF53D12AEE5B346E0DD3131B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

82352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sod90\dade\cugoyus.pdb

kernel32

CreateNamedPipeA TerminateThread DeactivateActCtx GetConsoleAliasesLengthW GetVersionExW GetConsoleOutputCP GetDefaultCommConfigW FindFirstFileExW GetDriveTypeA FreeEnvironmentStringsW GetProcessPriorityBoost SetVolumeMountPointW SetCurrentDirectoryW GetLongPathNameA TlsGetValue SetComputerNameExW FindAtomA BuildCommDCBAndTimeoutsA VirtualProtect GetModuleHandleA GlobalAlloc InitializeCriticalSection TlsSetValue GetCommandLineA InterlockedDecrement GetCalendarInfoA CopyFileW ZombifyActCtx OutputDebugStringW GetSystemTimeAdjustment GetPriorityClass WritePrivateProfileStringW GetProcessHeap GlobalUnWire HeapCompact GetStartupInfoA GetDiskFreeSpaceExW GetCPInfoExW GetWindowsDirectoryA GetSystemWow64DirectoryW GetProfileStringW WriteProfileSectionW GetProfileStringA SetConsoleCursorPosition GetLastError DeleteVolumeMountPointA DebugBreak GetPrivateProfileSectionW ReadFileScatter GetNumberOfConsoleInputEvents GetSystemWindowsDirectoryW TerminateProcess GlobalFindAtomA FindCloseChangeNotification CreateActCtxA SetMailslotInfo InterlockedExchange DefineDosDeviceA SetVolumeMountPointA EndUpdateResourceA WriteConsoleW GetPrivateProfileSectionA WritePrivateProfileSectionW GetPrivateProfileStructA TryEnterCriticalSection GetFileAttributesExW LocalFileTimeToFileTime MoveFileW GetVolumePathNameW HeapSetInformation lstrcmpW GetComputerNameA FindActCtxSectionStringA SetThreadContext MoveFileExA GlobalUnlock UnregisterWait BuildCommDCBW GlobalDeleteAtom GetShortPathNameA OpenEventA SetCommTimeouts WaitNamedPipeW CreateIoCompletionPort FindResourceExW GetSystemTimeAsFileTime GetSystemInfo SetLocalTime OpenSemaphoreA FreeEnvironmentStringsA GetProcAddress GetPrivateProfileSectionNamesA SetFileShortNameW lstrcpyW VerLanguageNameA GetThreadSelectorEntry GetSystemTime UnlockFile GetConsoleCP GetConsoleAliasW SetConsoleScreenBufferSize GetAtomNameA WriteConsoleInputW TransactNamedPipe SetCommState SetHandleCount _lopen ResetWriteWatch ClearCommBreak GetModuleHandleW GetOverlappedResult EnumDateFormatsW GetConsoleAliasExesLengthA WriteConsoleOutputCharacterW HeapReAlloc OpenMutexA GetStringTypeW SetFilePointer PostQueuedCompletionStatus AreFileApisANSI CancelWaitableTimer GetCurrentProcess PeekNamedPipe GetCompressedFileSizeW FindNextVolumeMountPointA GetFullPathNameW WriteProfileStringW InitAtomTable GlobalAddAtomA TerminateJobObject SetFirmwareEnvironmentVariableA GetBinaryTypeW QueryDosDeviceW LeaveCriticalSection CreateFileA InterlockedIncrement WideCharToMultiByte MultiByteToWideChar InterlockedCompareExchange Sleep DeleteCriticalSection EnterCriticalSection RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW MoveFileA LCMapStringA LCMapStringW GetCPInfo HeapValidate IsBadReadPtr TlsAlloc GetCurrentThreadId TlsFree SetLastError GetStdHandle WriteFile OutputDebugStringA GetFileType ExitProcess LoadLibraryW CloseHandle GetACP GetOEMCP IsValidCodePage QueryPerformanceCounter GetTickCount GetCurrentProcessId GetModuleFileNameA GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate HeapFree VirtualFree GetLocaleInfoA GetStringTypeA HeapAlloc HeapSize VirtualAlloc IsValidLocale EnumSystemLocalesA GetUserDefaultLCID FlushFileBuffers GetConsoleMode InitializeCriticalSectionAndSpinCount LoadLibraryA SetStdHandle GetLocaleInfoW WriteConsoleA

user32

OemToCharA

msimg32

AlphaBlend

Sharing

General

Malware Config

Signatures

File Explorer

d1431fc1eb6b6812b692b864eca7ba27b399f2f7a6027a0918f266bf27068847

kernel32

user32

msimg32

generic