fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576

Sharing

Copy URL Twitter E-mail

General

Target
fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576
Size 2.8MB
Sample260925-yfvp6sysdw
SHA256 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576
MD5 9675b7008f93b0c2b81197ef46c197d3
SHA1 882a3a9d428583b6dc63a8df619613e44a0aaa58
SHA512 febee58c4a1c48fb315e410165f4e8e6ca200a4ebfbd995dc61c88481b6fd4ed8e790415ea7fa1f770af740f545973df6bcbd45b98f5799a9d7fbc16e607657d
SSDEEP 49152:RlOF/9npqQUqQDVmFLhUvczqajco6h0uO9aGgV1t3zR8aS50BKCqY:zOF2UU0zzAlt18B50PqY
TLSH
T1CFD5BF0AE6A541E8CC76C135CC6E612AF87174DA873097F753915F7B2F227E1AA3A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576

File Explorer

fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576

.exe 2.8MB

fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576

IMPHASH 87b5d32cc813bc1b445fcdb5e5b1b176
SHA256 fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576
MD5 9675b7008f93b0c2b81197ef46c197d3
SHA1 882a3a9d428583b6dc63a8df619613e44a0aaa58
SHA512 febee58c4a1c48fb315e410165f4e8e6ca200a4ebfbd995dc61c88481b6fd4ed8e790415ea7fa1f770af740f545973df6bcbd45b98f5799a9d7fbc16e607657d
SSDEEP 49152:RlOF/9npqQUqQDVmFLhUvczqajco6h0uO9aGgV1t3zR8aS50BKCqY:zOF2UU0zzAlt18B50PqY
TLSH
T1CFD5BF0AE6A541E8CC76C135CC6E612AF87174DA873097F753915F7B2F227E1AA3A310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

360780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MulDiv GetSystemDefaultLangID ReadProcessMemory GetCurrentProcessId VirtualProtectEx GetProcAddress GetSystemDirectoryW GetVersionExW GetPrivateProfileStringW GetPrivateProfileIntW FindClose FindNextFileW FindFirstFileW lstrcmpW GetModuleFileNameW WritePrivateProfileStringW IsBadReadPtr WideCharToMultiByte Thread32Next SuspendThread OpenThread Thread32First CreateToolhelp32Snapshot GetCurrentThreadId InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetExitCodeProcess WaitForSingleObject Sleep DeleteFileW CreateThread UnmapViewOfFile MapViewOfFile CreateFileMappingW DeleteCriticalSection RaiseException SetLastError FlushInstructionCache GetCurrentProcess lstrcmpiW CompareStringW FreeLibrary LoadLibraryExW WriteConsoleA LoadLibraryA InitializeCriticalSectionAndSpinCount FlushFileBuffers SetStdHandle GetLocaleInfoA SizeofResource GetStringTypeA LCMapStringW LCMapStringA GetConsoleMode GetConsoleCP MultiByteToWideChar GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle ExitProcess HeapSize HeapReAlloc HeapCreate HeapSetInformation IsValidCodePage GetOEMCP GetACP GetCPInfo FlsAlloc FlsFree FlsSetValue FlsGetValue DecodePointer EncodePointer GetStartupInfoW HeapAlloc HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry WriteConsoleW GetConsoleOutputCP SetEndOfFile GetProcessHeap LoadResource LockResource GetModuleHandleW CreateFileA InterlockedPushEntrySList VirtualFree VirtualAlloc InterlockedPopEntrySList CreateProcessW GetLastError VirtualAllocEx WriteProcessMemory LoadLibraryW QueueUserAPC ResumeThread TerminateProcess CloseHandle LockFile GetFileSize ReadFile UnlockFile CreateFileW MoveFileExW WriteFile lstrlenA OutputDebugStringW DebugBreak SetFilePointer FindResourceW lstrlenW GetCommandLineW GetStringTypeW LocalFree

user32

OffsetRect GetDlgCtrlID LoadCursorW ScreenToClient GetCursorPos GetCapture GetFocus GetSysColor IsWindowEnabled FillRect DrawFocusRect SetWindowLongPtrW GetWindowLongPtrW CallWindowProcW SystemParametersInfoW ReleaseCapture SetFocus SetCapture PtInRect SetCursor CreateDialogParamW EndDialog DialogBoxParamW SetRectEmpty CreateWindowExW DestroyWindow DefWindowProcW MessageBoxW PostQuitMessage CheckDlgButton ClientToScreen TrackPopupMenu IsDlgButtonChecked GetActiveWindow UpdateWindow SetWindowLongW GetClassNameW GetParent GetWindow GetWindowRect GetWindowLongW MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos LoadMenuW GetSubMenu GetSystemMetrics LoadImageW GetWindowTextLengthW RegisterWindowMessageW IsWindow IsDialogMessageW GetClassInfoW RegisterClassW ShowWindow PeekMessageW GetMessageW TranslateMessage DispatchMessageW PostMessageW wsprintfW AppendMenuW CheckMenuItem GetDlgItem ModifyMenuW SetWindowTextW SetDlgItemTextW CharLowerW BeginPaint SetRect DrawTextW EndPaint GetWindowTextW EnumChildWindows ReleaseDC GetDC CharUpperW SendMessageW CharNextW LoadStringW InvalidateRect UnregisterClassA

gdi32

GetObjectW GetStockObject CreateFontIndirectW DeleteDC SelectObject SetTextColor CreateFontW DeleteObject EnumFontFamiliesExW GetDeviceCaps SetBkMode

comdlg32

ChooseFontW GetOpenFileNameW

advapi32

RegCloseKey RegQueryInfoKeyW RegOpenKeyExW RegQueryValueExW RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegEnumKeyExW RegSetValueExW

shell32

CommandLineToArgvW ShellExecuteW

ole32

CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoTaskMemAlloc CoTaskMemRealloc

oleaut32

SysAllocString SysFreeString VarUI4FromStr

shlwapi

SHGetValueW SHSetValueW PathRemoveFileSpecW PathFileExistsW PathFindFileNameW

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

fcb0267966486525e03095ade3952697405f01d58c5fbcf604b06eadfeb04576

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

generic