e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f

Sharing

Copy URL Twitter E-mail

General

Target
e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f
Size 181KB
Sample260930-npfbqstfne
SHA256 e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f
MD5 5cf2c8637cd394261b63a72a9e20c47c
SHA1 61180fab28e1b6e81557a2421c0e71dd141564a8
SHA512 d7d0e99f8b1260eafc1ccd05eaab181759554276e3a0b4da4ef3b8d814ad5b4d73cb3e6cded60fb925cd66a84d77d136a1c3a4b6fa03bdd8fe6d856e678a87b4
SSDEEP 3072:JW5BMsp6UwWnsMk/VDbpSMDAEVUgM1ckVPxIiToADGhOJmh:JE6U6Th5SMDAbPDCOQ
TLSH
T1E3044A07F555607FD85AC6B88A43C522BBB278864BA066CF27518FB90D27FD85F38341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f

File Explorer

e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f

.dll 181KB

e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f

IMPHASH b411bfa83cdaa69bcc16ead670b104cf
SHA256 e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f
MD5 5cf2c8637cd394261b63a72a9e20c47c
SHA1 61180fab28e1b6e81557a2421c0e71dd141564a8
SHA512 d7d0e99f8b1260eafc1ccd05eaab181759554276e3a0b4da4ef3b8d814ad5b4d73cb3e6cded60fb925cd66a84d77d136a1c3a4b6fa03bdd8fe6d856e678a87b4
SSDEEP 3072:JW5BMsp6UwWnsMk/VDbpSMDAEVUgM1ckVPxIiToADGhOJmh:JE6U6Th5SMDAbPDCOQ
TLSH
T1E3044A07F555607FD85AC6B88A43C522BBB278864BA066CF27518FB90D27FD85F38341
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW LogonUserW RegOpenKeyExW RegQueryValueExW

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileMappingW CreateProcessW CreateToolhelp32Snapshot DisableThreadLibraryCalls EncodePointer ExitProcess ExpandEnvironmentStringsW FindResourceW FlushInstructionCache FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileSectionW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetThreadContext GetTickCount64 GetVolumeInformationW InitializeSListHead InterlockedFlushSList K32GetModuleInformation LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MulDiv OpenFileMappingW Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive ResumeThread RtlUnwindEx SetEnvironmentVariableW SetLastError SetThreadContext SizeofResource Sleep SleepConditionVariableSRW SuspendThread TerminateProcess UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable lstrcatW lstrcmpiW lstrcpyW

crypt32

CryptProtectData CryptUnprotectData

samcli

NetUserGetInfo

user32

CallNextHookEx ClientToScreen DispatchMessageW EnumChildWindows EnumWindows GetAncestor GetAsyncKeyState GetCapture GetClassNameW GetClientRect GetCursorPos GetFocus GetForegroundWindow GetKeyState GetMessageW GetMonitorInfoW GetParent GetSystemMetrics GetWindowRect GetWindowThreadProcessId IsRectEmpty IsWindowVisible KillTimer MonitorFromWindow PostMessageW PtInRect RegisterHotKey SendInput SetActiveWindow SetCursorPos SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage VkKeyScanW WindowFromPoint keybd_event

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

shell32

CommandLineToArgvW SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID

shlwapi

ord437 PathCanonicalizeW PathRemoveFileSpecW StrStrIW

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

msvcrt

?terminate@@YAXXZ _CxxThrowException __C_specific_handler __CppXcptFilter __CxxFrameHandler3 __DestructExceptionObject __getmainargs _amsg_exit _beginthreadex _callnewh _errno _initterm _initterm_e _local_unwind _msize _wcsicmp _wsystem abort ceilf free isspace iswalnum iswdigit malloc memcmp memcpy memmove memset realloc strcmp strcpy_s strlen towlower towupper wcslen wcsrchr wcsstr wcstoul

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

42B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e2558703bc75618b69d5e2e7d3318f478488f3f15b1b925fcdb4a0363fc3199f

advapi32

kernel32

crypt32

samcli

user32

ole32

shell32

shlwapi

oleaut32

msvcrt

generic