deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624

General

Target
deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624
Size 1.3MB
Sample260925-ks3dwsce74
SHA256 deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624
MD5 fcada1d7b11e5038332cbcf6523e0b81
SHA1 c4b23bce2cd92f574f66d658d179009d6fb27942
SHA512 70fe7fe8e083b7fe93e5abab735800250b83923089984a8d8ab4695acf18660cbdd095448319c39372225ea6e259464eb864630a9aef2aedbff64fad4fcf6ccf
SSDEEP 12288:AERy9YBDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A6dDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17155025B73A820FAD0774279C9A19509F73378764B208A9F17A0567E6F732D08E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624

File Explorer

deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624

.exe 1.3MB

deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624

IMPHASH c544fd4007bc134b062cf6be36560d85
SHA256 deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624
MD5 fcada1d7b11e5038332cbcf6523e0b81
SHA1 c4b23bce2cd92f574f66d658d179009d6fb27942
SHA512 70fe7fe8e083b7fe93e5abab735800250b83923089984a8d8ab4695acf18660cbdd095448319c39372225ea6e259464eb864630a9aef2aedbff64fad4fcf6ccf
SSDEEP 12288:AERy9YBDXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:A6dDsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17155025B73A820FAD0774279C9A19509F73378764B208A9F17A0567E6F732D08E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\wjc\actioncenter\IWscAVStatus\x64\Release\IWscAVStatus.pdb

kernel32

OutputDebugStringW VerSetConditionMask VerifyVersionInfoW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection WriteConsoleW CreateFileW InitializeCriticalSectionEx GetLastError IsDebuggerPresent RaiseException CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType CompareStringW LCMapStringW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysAllocString

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

deda81f051fded9f1932d386f6a7e35083d5d5b0c32f5b982eb9b0367977e624

kernel32

ole32

oleaut32

generic