6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5

Sharing

Copy URL Twitter E-mail

General

Target
6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5
Size 2.0MB
Sample260925-v5wf8asdkh
SHA256 6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5
MD5 46d52c5f039ff530352554c89a252300
SHA1 50f20b0df82c50aba7f97a113f8849e216ceb62a
SHA512 aacc648beba5b5087d956fed9424820894c992045b8d8a77787735452eb12832924aee8965756b4fd0f4cdecabd1bcef39ae1e4848c6591df383d0f4e43614cd
SSDEEP 49152:BBNpjbETIARAAGF3HrTUukbHp69HpDd97BZuzJ:AeF3Hsuqe
TLSH
T179A58C017645D132E69C01B02D3DEEB95A7CA93D4B3445C7B3E8AEBA96205C72F31E1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5

File Explorer

6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5

.dll 2.0MB

6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5

IMPHASH 82846fb4e5bc7c73ea55e020e46e6d7d
SHA256 6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5
MD5 46d52c5f039ff530352554c89a252300
SHA1 50f20b0df82c50aba7f97a113f8849e216ceb62a
SHA512 aacc648beba5b5087d956fed9424820894c992045b8d8a77787735452eb12832924aee8965756b4fd0f4cdecabd1bcef39ae1e4848c6591df383d0f4e43614cd
SSDEEP 49152:BBNpjbETIARAAGF3HrTUukbHp69HpDd97BZuzJ:AeF3Hsuqe
TLSH
T179A58C017645D132E69C01B02D3DEEB95A7CA93D4B3445C7B3E8AEBA96205C72F31E1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1178784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

PathFileExistsW PathMatchSpecW

kernel32

OpenProcess VirtualQueryEx K32GetModuleFileNameExW SetEvent ReleaseMutex Sleep GetCurrentThreadId GetThreadId GetModuleHandleW GetProcAddress IsDBCSLeadByteEx GetTickCount64 VirtualAlloc VirtualFree OpenFileMappingW IsBadReadPtr WideCharToMultiByte lstrlenW lstrcatA IsDBCSLeadByte IsBadWritePtr GetStringTypeExW lstrlenA IsDebuggerPresent OutputDebugStringA OutputDebugStringW FindClose FindFirstFileW FindNextFileW GetModuleHandleA CreateEventA MultiByteToWideChar GetACP AddVectoredExceptionHandler RemoveVectoredExceptionHandler DecodePointer InitializeCriticalSectionEx DeleteCriticalSection LoadLibraryW GetCurrentProcess GetNativeSystemInfo LockResource GlobalLock K32EnumProcessModules GetFileSizeEx HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache CreateToolhelp32Snapshot Thread32First Thread32Next RaiseException GetSystemInfo FreeLibrary LoadLibraryExA FlushFileBuffers SetStdHandle HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetTimeZoneInformation GetOEMCP IsValidCodePage SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GlobalUnlock GlobalAlloc FindResourceW SizeofResource LoadResource GetModuleFileNameW FreeResource WriteConsoleW FreeLibraryAndExitThread DisableThreadLibraryCalls UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualQuery VirtualProtect CreateThread GetCurrentProcessId CreateEventW CreateMutexW WaitForSingleObject SetNamedPipeHandleState GetLastError CloseHandle WriteFile ReadFile CreateFileW GlobalFree LCMapStringW CompareStringW ReadConsoleW SetEndOfFile EnumResourceNamesW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter GetSystemTimePreciseAsFileTime EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread GetModuleHandleExW ExitProcess TerminateProcess UnhandledExceptionFilter GetStdHandle GetFileType LoadLibraryExW GetDateFormatW GetTimeFormatW

user32

GetWindowTextLengthW GetWindowTextW IsWindowEnabled IsWindowVisible IsWindow ReleaseDC GetWindowThreadProcessId DrawTextW GetKeyState wsprintfW CharNextA DrawTextExW DrawTextExA DrawTextA CharPrevA SetClipboardData EnumWindows

gdi32

RemoveFontResourceExW AddFontResourceExW DeleteObject CreateCompatibleDC GetTextFaceW GetTextMetricsW SelectObject ExtTextOutW GetTextExtentExPointA CreateFontW CreateFontA CreateFontIndirectW GetCharABCWidthsA CreateFontIndirectA GetCharacterPlacementW GetTextExtentExPointW GetCharWidth32W GetTextExtentPoint32W TextOutW GetCharABCWidthsW GetGlyphOutlineW TextOutA GetGlyphOutlineA ExtTextOutA GetTextExtentPoint32A GetTextMetricsA

shell32

SHGetKnownFolderPath

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

300KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6066e5f96979821a45ea32a4d237e419faec120769f958eefc49b582f8e33ea5

shlwapi

kernel32

user32

gdi32

shell32

advapi32

generic