9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd

Sharing

Copy URL Twitter E-mail

General

Target
9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd
Size 120KB
Sample260930-ky9edsvbqe
SHA256 9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd
MD5 6aedaf998e19d7bca2b559470bbd7ae0
SHA1 0fe52af339dc72e9becefee31508e29c0addf4d4
SHA512 e0b06fc107b7288d4ed8c7af210ebc39bed0cae4aa6245966248c5f17788bec0807b82989f9cfb2671cab14841436d087945c3a4e27c62085b6fd8e0d4fe2a66
SSDEEP 3072:zCGT+H5BQWm6jUp4UCbWSO7S7TyRQxjHJ3Vq4xf1:zRWfmXpUW/SdHbqkf1
TLSH
T106C38D00B5D08072E5B6193118B4DEB2997EFD744F605EDFA3C84AB99E306C18A35B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd

File Explorer

9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd

.exe 120KB

9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd

IMPHASH 21295d3cfcfa250ca2229d3e2b94174e
SHA256 9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd
MD5 6aedaf998e19d7bca2b559470bbd7ae0
SHA1 0fe52af339dc72e9becefee31508e29c0addf4d4
SHA512 e0b06fc107b7288d4ed8c7af210ebc39bed0cae4aa6245966248c5f17788bec0807b82989f9cfb2671cab14841436d087945c3a4e27c62085b6fd8e0d4fe2a66
SSDEEP 3072:zCGT+H5BQWm6jUp4UCbWSO7S7TyRQxjHJ3Vq4xf1:zRWfmXpUW/SdHbqkf1
TLSH
T106C38D00B5D08072E5B6193118B4DEB2997EFD744F605EDFA3C84AB99E306C18A35B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateFileW CloseHandle TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW GetTempPathW GetCurrentProcessId QueryFullProcessImageNameW GetLocalTime DecodePointer WriteFile GetFileAttributesW MoveFileExW DeleteFileW GetLastError SetFileAttributesW FindClose GetModuleFileNameW RemoveDirectoryW FindNextFileW GetFullPathNameW Process32FirstW FindFirstFileExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW WriteConsoleW

user32

MessageBoxW

advapi32

RegCreateKeyExW RegDeleteTreeW RegSetValueExW RegDeleteValueW CloseServiceHandle OpenSCManagerW DeleteService ControlService OpenServiceW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

SHGetKnownFolderPath

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit

Sharing

General

Malware Config

Signatures

File Explorer

9ba7b7810c8dc65c68a94e4b01983915b79e18f25e05d7c2f622b7f09d016dfd

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic