327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4

General

Target
327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4
Size 656KB
Sample260920-e64k8a1xhv
SHA256 327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4
MD5 864696268f8fcdfb8d8c1bbddbc3f301
SHA1 20c8d682007bfb404e4df91531a1904832c6c4e8
SHA512 f2b5de4b835b5f4c5db382283cb57ecec21d118d578bb7d6fe04a2b28789c2e2b7eb083cf969cef2f84c705cdeaffd96252079a3850402a94e931a2e066da551
SSDEEP 6144:9MT9b2lNpjk4ldH1uOs5C8IkEB+y0tO4uHxoPjMdvNZRhA71pr2AuTVUq:WTYpjkmJk1dEBoPCxI2zjA71pr2AuTd
TLSH
T175E4956FD932FA04C74EE83824749C5F859B1E186CE0961DC250BB19457BAF037EB1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4

File Explorer

327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4

.exe 656KB

327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4

IMPHASH 9c42f19388d9cdd246ee9e3dd241d9cf
SHA256 327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4
MD5 864696268f8fcdfb8d8c1bbddbc3f301
SHA1 20c8d682007bfb404e4df91531a1904832c6c4e8
SHA512 f2b5de4b835b5f4c5db382283cb57ecec21d118d578bb7d6fe04a2b28789c2e2b7eb083cf969cef2f84c705cdeaffd96252079a3850402a94e931a2e066da551
SSDEEP 6144:9MT9b2lNpjk4ldH1uOs5C8IkEB+y0tO4uHxoPjMdvNZRhA71pr2AuTVUq:WTYpjkmJk1dEBoPCxI2zjA71pr2AuTd
TLSH
T175E4956FD932FA04C74EE83824749C5F859B1E186CE0961DC250BB19457BAF037EB1AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

312512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

pmmplk.bb.pd

Name

.rda

Size

304KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data1

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.m5Fih

Size

4KB

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

208KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

108KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=429, id=223, productName=VS2013 UPD3 build 30723, version=30723,

count=179, id=259, productName=VS2015 UPD3 build 24210, version=24210,

count=231, id=157, productName=VS2010 build 30319, version=30319,

count=411, id=145, productName=VS2008 SP1 build 30729, version=30729,

count=365, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=133, id=257, productName=VS2017 v15.5.4 build 25834, version=25834,

count=189, id=225, productName=VS2013 build 21005, version=21005,

count=85, id=259, productName=VS2017 v15.5.4 build 25834, version=25834,

count=393, id=1, productName=Unmarked objects,

count=17, id=258, productName=VS2015 UPD2 build 23918, version=23918,

count=265, id=224, productName=VS2013 UPD2 build 30501, version=30501,

count=157, id=155, productName=VS2010 SP1 build 40219, version=40219,

count=226, id=146, productName=VS2008 SP1 build 30729, version=30729,

count=233, id=122, productName=VS2005 build 50727, version=50727,

327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4

wininet

winspool.drv

powrprof

msvcrt

user32

gdi32

kernel32

ole32

generic

Sharing

General

Malware Config

Signatures

File Explorer

327e3f4a89e8fe4a7e18c1a17632199cfcbbdb8e0b2078aeab02a0cd23db88e4

wininet

winspool.drv

powrprof

msvcrt

user32

gdi32

kernel32

ole32

generic