2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b

General

Target
2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b
Size 3.4MB
Sample260925-kr4wbsxtew
SHA256 2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b
MD5 1dd267892b7d0f651130f747d55068f2
SHA1 4427c8f7523383e13ebd62b310bde1de2e2959c2
SHA512 f8ddfadfead253c2abd2702565d82cb222ed66bc4af50042af80b29aed77946c7887bd4f09b6cbc9903aad5d02631c52e41693ea40d0e0d89ee587c2a8de5be9
SSDEEP 49152:/yDQkeCmaxbwAgIubaJY7Qyo3r0K0BsBacA65ecOh24Th3pCd4OnJm6gEwHHYwkM:/yDQkeSLhuba4o3r0fCjAz3
TLSH
T1BDF53A21F247C427D6A601B11A2CEF9E81387E261BB514D777DC2EAE1BB54C21236F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b

File Explorer

2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b

.exe 3.4MB

2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b

IMPHASH 4d363d3b473a6c355539abd95921390d
SHA256 2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b
MD5 1dd267892b7d0f651130f747d55068f2
SHA1 4427c8f7523383e13ebd62b310bde1de2e2959c2
SHA512 f8ddfadfead253c2abd2702565d82cb222ed66bc4af50042af80b29aed77946c7887bd4f09b6cbc9903aad5d02631c52e41693ea40d0e0d89ee587c2a8de5be9
SSDEEP 49152:/yDQkeCmaxbwAgIubaJY7Qyo3r0K0BsBacA65ecOh24Th3pCd4OnJm6gEwHHYwkM:/yDQkeSLhuba4o3r0fCjAz3
TLSH
T1BDF53A21F247C427D6A601B11A2CEF9E81387E261BB514D777DC2EAE1BB54C21236F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1929108

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread LoadLibraryExW GetCurrentProcess Sleep WideCharToMultiByte GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetEnvironmentStringsW InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID GetLocalTime ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW CreateNamedPipeW ConnectNamedPipe TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW GetProcessAffinityMask GetModuleHandleA GlobalMemoryStatus ReleaseSemaphore CreateSemaphoreW

Sharing

General

Malware Config

Signatures

File Explorer

2eaaa7313c13c638e905bc1b5f3416c7974124707a3f26c732d7b64dad60778b

kernel32

generic