e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438

Sharing

Copy URL Twitter E-mail

General

Target
e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438
Size 107KB
Sample260922-v6mkpsbf57
SHA256 e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438
MD5 bfde028535540c2966664d96283eed61
SHA1 4671ff69bb47e8bdaedac79582cd002bd3d26f5b
SHA512 fb9570a8fb5c25937299b34e7353135d270ccf146cbabc4973c3f232d64d5d0475887568c832f0bce64e63719d79aa5b1b35f6a6d651e31065afa4da3c9859b0
SSDEEP 1536:BHGMfDVw9NeHq+tm1nkK6K3p2NJCXBLE2L:BHGcJw9Nmsrl2NJKE2L
TLSH
T182B3944377F60589F4F2DA35A8714232A6737C542931CB0F4A94C42D2E7B690AE7AF36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438

File Explorer

e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438

.dll 107KB

e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438

IMPHASH 6bbc82eb82b0a879695a3171327723e3
SHA256 e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438
MD5 bfde028535540c2966664d96283eed61
SHA1 4671ff69bb47e8bdaedac79582cd002bd3d26f5b
SHA512 fb9570a8fb5c25937299b34e7353135d270ccf146cbabc4973c3f232d64d5d0475887568c832f0bce64e63719d79aa5b1b35f6a6d651e31065afa4da3c9859b0
SSDEEP 1536:BHGMfDVw9NeHq+tm1nkK6K3p2NJCXBLE2L:BHGcJw9Nmsrl2NJKE2L
TLSH
T182B3944377F60589F4F2DA35A8714232A6737C542931CB0F4A94C42D2E7B690AE7AF36
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileW CreateProcessW CreateThread DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetFileAttributesW GetFileSize GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetProcessHeap GetSystemDirectoryW GetUserDefaultUILanguage GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar ReadFile ReadProcessMemory SearchPathW Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte lstrcpynA lstrcpynW

msvcrt

__iob_func _amsg_exit _initterm _lock _snwprintf_s _unlock _wcsicmp _wcsnicmp abort calloc fprintf free memcpy realloc strlen strncmp swprintf_s towlower vfprintf wcschr wcscmp wcscpy_s wcslen wcsncpy wcsncpy_s wcsstr

ole32

CoCreateInstance CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop StringFromGUID2

oleacc

AccessibleObjectFromPoint

oleaut32

SysFreeString SysStringLen VariantInit

shell32

DragQueryFileW ILCombine ILCreateFromPathW ILFree SHChangeNotify SHGetFolderPathW SHGetPathFromIDListW ShellExecuteExW ShellExecuteW StrStrIW

shlwapi

PathCombineW PathFindExtensionW PathRemoveFileSpecW

user32

AppendMenuW CallNextHookEx ClientToScreen CreatePopupMenu DeleteMenu DestroyMenu DestroyWindow DispatchMessageW EnumChildWindows FindWindowExW FindWindowW GetAncestor GetClassNameW GetForegroundWindow GetGUIThreadInfo GetMenuItemCount GetMenuItemInfoW GetParent GetPropW GetWindowLongPtrW GetWindowRect GetWindowThreadProcessId InsertMenuItemW IsWindow MsgWaitForMultipleObjects PeekMessageW PostMessageW RedrawWindow RegisterClipboardFormatW RegisterWindowMessageW SendMessageTimeoutW SetForegroundWindow SetMenuDefaultItem SetWindowsHookExW ShowWindow TrackPopupMenuEx TranslateMessage UnhookWindowsHookEx wsprintfW

Name

.text

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e14e3e17e637b9ffc03dd45a6d607f6bb2b90017523662b40961fda10b65c438

advapi32

kernel32

msvcrt

ole32

oleacc

oleaut32

shell32

shlwapi

user32

generic