19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54

Sharing

Copy URL Twitter E-mail

General

Target
19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54
Size 13.1MB
Sample260922-kpvvmsca48
SHA256 19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54
MD5 b87115586d647df768b3883094da15e4
SHA1 91f83499428600ec5435c978c79c223dced571c1
SHA512 0414924291af9a4f5f73fa22925fc9db4f2a8a6665d1e5a451fad6519029f1f94a046581ed5ab29610c936b9f7e3adf8502b133141ea2bc03c4efe66196d2368
SSDEEP 393216:2fmID2IvpmIE+1CPwDv3uFhjU2lvzE0D8:3ID2Ivp2oG
TLSH
T19BD6BE10FA4251B2FCA6F1B692EB07774B258E265315C1D3F48C75896F313E31A7A28E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54

File Explorer

19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54

.exe 13.1MB

19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54

IMPHASH dead1c08fb9a77debfda9910ed3b6473
SHA256 19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54
MD5 b87115586d647df768b3883094da15e4
SHA1 91f83499428600ec5435c978c79c223dced571c1
SHA512 0414924291af9a4f5f73fa22925fc9db4f2a8a6665d1e5a451fad6519029f1f94a046581ed5ab29610c936b9f7e3adf8502b133141ea2bc03c4efe66196d2368
SSDEEP 393216:2fmID2IvpmIE+1CPwDv3uFhjU2lvzE0D8:3ID2Ivp2oG
TLSH
T19BD6BE10FA4251B2FCA6F1B692EB07774B258E265315C1D3F48C75896F313E31A7A28E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddDllDirectory CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceA FormatMessageA FreeLibrary GenerateConsoleCtrlEvent GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetProcAddress GetProcessId GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection IsDBCSLeadByteEx K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadResource LockResource MapViewOfFile MultiByteToWideChar OpenProcess ReadFile SetConsoleCtrlHandler SetDllDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__argc __mb_cur_max __p__commode __p__fmode __p__wcmdln __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _errno _initterm _iob _lock _onexit _unlock _wcsdup _wcsicmp _wrename abort atoi calloc exit fprintf fputc fputwc free fwprintf fwrite iswctype localeconv malloc mbstowcs memcpy memset puts setlocale signal strchr strerror strlen strncmp vfprintf wcschr wcscmp wcslen wcsncmp wcstoul

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13.0MB

Virtual Size

13.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

19ca83e81fcbe41192385ed71ee3a1a3344b0e04d73cd02159de95c5d3f71c54

kernel32

msvcrt

shell32

generic