fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7

General

Target
fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7
Size 220KB
Sample260930-a1jlmsba74
SHA256 fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7
MD5 629cdbe050815a321f8ff9231d1d6a48
SHA1 00785ce780ad5a7b9835bda04f2314155916bca5
SHA512 eebcbd4ba5f7aafb3f86f82b0026104e20cd4a6afae1cbb7fe486c562ba4d18bfef1f73609e0e6beb4362e7e26f95a2aa2211ab5fd12741538c2b2d5224b5219
SSDEEP 3072:CXVZgMWUmOETGREuPZC7g2encYmKn1KWoWmmcG6vUu:u4GaTwErfxnG6vU
TLSH
T10324C3817AE31112F57B1BB43DFDA472E63ABE725B328ACF4210925906E32D1587C772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7

File Explorer

fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7

.dll 220KB

fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7

IMPHASH df94e7c8995a1db2b713368622cf2c1f
SHA256 fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7
MD5 629cdbe050815a321f8ff9231d1d6a48
SHA1 00785ce780ad5a7b9835bda04f2314155916bca5
SHA512 eebcbd4ba5f7aafb3f86f82b0026104e20cd4a6afae1cbb7fe486c562ba4d18bfef1f73609e0e6beb4362e7e26f95a2aa2211ab5fd12741538c2b2d5224b5219
SSDEEP 3072:CXVZgMWUmOETGREuPZC7g2encYmKn1KWoWmmcG6vUu:u4GaTwErfxnG6vU
TLSH
T10324C3817AE31112F57B1BB43DFDA472E63ABE725B328ACF4210925906E32D1587C772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

spoolss

EnumPortsW

user32

LoadStringW wsprintfW

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcpy memmove strchr strcmp strcpy strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

fa3bad4cbeb433fd74315f1d289052f05993373b5b7569f5e1953eec701482a7

spoolss

user32

advapi32

ucrtbase

kernel32

ntdll

generic