f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28

Sharing

Copy URL Twitter E-mail

General

Target
f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28
Size 782KB
Sample260929-prtskshb79
SHA256 f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28
MD5 5e42b05d0cf530cc77789d49fc0bdf80
SHA1 25beb8698497fdb8e5355f8f386e352d0c64d95f
SHA512 2742e906d95fa5ada8c94c4ab610912d57c568b1063465f65ee4400f7e0ea6215666868806cf361767f2897d3613fdd511f491c8f5159eb3b31f590e451984cf
SSDEEP 24576:xkILcSFMRqLuCs8SnkwFM/v0LZKMvT21tQ35:OILcWMRqLps8jKMH0EvQ35
TLSH
T1DE059D90B9519171D87291F24B79ABB9452EAC308B3114E7A3D4BE292D305C3BF3763B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28

File Explorer

f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28

.exe 782KB

f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28

IMPHASH 6d7ff2d5172ec985d1eb41fe73fbd361
SHA256 f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28
MD5 5e42b05d0cf530cc77789d49fc0bdf80
SHA1 25beb8698497fdb8e5355f8f386e352d0c64d95f
SHA512 2742e906d95fa5ada8c94c4ab610912d57c568b1063465f65ee4400f7e0ea6215666868806cf361767f2897d3613fdd511f491c8f5159eb3b31f590e451984cf
SSDEEP 24576:xkILcSFMRqLuCs8SnkwFM/v0LZKMvT21tQ35:OILcWMRqLps8jKMH0EvQ35
TLSH
T1DE059D90B9519171D87291F24B79ABB9452EAC308B3114E7A3D4BE292D305C3BF3763B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130768

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindNextFileW FindClose MoveFileExW CreateTimerQueue UnregisterWaitEx QueryDepthSList GetFullPathNameW FindFirstFileW lstrlenW SetCurrentDirectoryW GetSystemDirectoryW SetLastError InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority IsDebuggerPresent FormatMessageW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo GetCurrentThreadId GetCurrentProcessId CreateMutexW GetCurrentProcess GetModuleFileNameW GetTempPathW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess GetCurrentDirectoryW K32GetProcessImageFileNameW GetLogicalDriveStringsW QueryDosDeviceW LocalFree ExpandEnvironmentStringsW GetLongPathNameW GetEnvironmentVariableW GetLocalTime K32EnumProcesses TerminateProcess GetFileAttributesW SetFileAttributesW DeleteFileW RemoveDirectoryW ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead CreateFileW ReadFile WriteFile FlushFileBuffers RtlUnwind InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW GetTimeZoneInformation GetFileType GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCurrentThread IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle SetEndOfFile ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW SignalObjectAndWait TryEnterCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionEx DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection Sleep WaitForSingleObject SetEvent CloseHandle CreateEventW lstrcmpiW OutputDebugStringW FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FreeLibrary LoadLibraryW K32GetModuleFileNameExW GetProcAddress

user32

wsprintfW FindWindowExW PostMessageW

advapi32

CloseServiceHandle DeleteService ControlService OpenServiceW OpenSCManagerW RegDeleteValueW RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

CommandLineToArgvW SHGetKnownFolderPath SHFileOperationW SHGetSpecialFolderPathW SHChangeNotify

ole32

CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CLSIDFromProgID

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

shlwapi

SHSetValueW SHDeleteKeyW PathCombineW PathFileExistsW SHGetValueW PathFindFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

f3122418d5922f9a1b0fbf7cf29f5aff80d95cdeacd550473e2b35b940012f28

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic