1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82

Sharing

Copy URL Twitter E-mail

General

Target
1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82
Size 62KB
Sample260925-rxea7ayarc
SHA256 1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82
MD5 bed0ddc180aa59e61080ec4ec6bc1929
SHA1 c57595aa96960b885d7794605b5c09c17e840f8c
SHA512 dd73f481c22c2c12ec4c413d49364bb159e803a43f5e84d3579ea44a48a0403a0074b6ee52410d013658eb08193851ce9291b54c05f6ba20b33cd29bac3ef37d
SSDEEP 1536:CQ+e3ETEDmUr1QDymC7Jh6S7AEWoxDze4:D+eUTW/ruDyhPUE9ze4
TLSH
T1A253D81EB3A6109CD9B7D238CAFB9631E772785011706F5E03A0C5653DF1E906E39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82

File Explorer

1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82

.exe 62KB

1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82

IMPHASH b96db895f74e26c3be00c3ad24a73db5
SHA256 1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82
MD5 bed0ddc180aa59e61080ec4ec6bc1929
SHA1 c57595aa96960b885d7794605b5c09c17e840f8c
SHA512 dd73f481c22c2c12ec4c413d49364bb159e803a43f5e84d3579ea44a48a0403a0074b6ee52410d013658eb08193851ce9291b54c05f6ba20b33cd29bac3ef37d
SSDEEP 1536:CQ+e3ETEDmUr1QDymC7Jh6S7AEWoxDze4:D+eUTW/ruDyhPUE9ze4
TLSH
T1A253D81EB3A6109CD9B7D238CAFB9631E772785011706F5E03A0C5653DF1E906E39B29
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AddMandatoryAce AdjustTokenPrivileges ChangeServiceConfigW CloseServiceHandle ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessWithTokenW DuplicateTokenEx EqualSid GetLengthSid GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation InitializeAcl InitializeSecurityDescriptor LookupAccountNameW LookupPrivilegeNameW LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegSetValueExW RevertToSelf SetNamedSecurityInfoW SetSecurityDescriptorDacl SetThreadToken SetTokenInformation StartServiceW

bcrypt

BCryptGenRandom

gdi32

CreateSolidBrush

kernel32

CloseHandle CreateFileW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeviceIoControl EnterCriticalSection ExitProcess FlushFileBuffers FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetSystemTimeAsFileTime GetThreadId GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree Module32FirstW Module32NextW OpenProcess OpenThread Process32FirstW Process32NextW QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFilePointer SetFilePointerEx SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess Thread32First Thread32Next TlsGetValue UnhandledExceptionFilter VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WriteFile WriteProcessMemory

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fmode _initterm _lock _onexit _unlock _vscwprintf _vsnwprintf _wcsdup _wcsicmp abort calloc exit fprintf free fwrite malloc mbstowcs memcpy memset signal strlen strncmp vfprintf wcscmp wcscpy wcslen wprintf

user32

CloseDesktop CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EnumDesktopsW GetMessageW GetProcessWindowStation GetSystemMetrics MessageBoxW OpenDesktopW PostThreadMessageW RegisterClassW SetLayeredWindowAttributes SetThreadDesktop SetWindowPos ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1dfa0a3ad7b53e4fc6f3d89af882c7c5809f6a8936b22ba8f5b0f1ff8996fa82

advapi32

bcrypt

gdi32

kernel32

msvcrt

user32

generic