6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074

General

Target
6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074
Size 3.8MB
Sample260930-prtgtafd99
SHA256 6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074
MD5 b270ab73f7460f285b48ed1086e3e70a
SHA1 bb06a2223593ffcfa7b7954b4eede6c58e425fc0
SHA512 6d4c5c04db988cbd5225d079a41f0567bf60cd9b2ab29d74e5b77e0fca3d5457aad88d457a9be43fc039cec570906124f972fe5a1ee1c268229c6a93108d70a3
SSDEEP 49152:v6YHQ1NS5F70ff5bRE9CLcK8bZ2ypGMsm5jZ+Cet11UXRo3RkeHUUKQvwtpateIx:CYHQyT0ff597X8bZ2ypGyQ
TLSH
T1EF063A21B247C426D66F03B1692CEE9E91386F223B6354D7B6DC3D6E1B708C21636E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074

File Explorer

6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074

.exe 3.8MB

6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074

IMPHASH 4d363d3b473a6c355539abd95921390d
SHA256 6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074
MD5 b270ab73f7460f285b48ed1086e3e70a
SHA1 bb06a2223593ffcfa7b7954b4eede6c58e425fc0
SHA512 6d4c5c04db988cbd5225d079a41f0567bf60cd9b2ab29d74e5b77e0fca3d5457aad88d457a9be43fc039cec570906124f972fe5a1ee1c268229c6a93108d70a3
SSDEEP 49152:v6YHQ1NS5F70ff5bRE9CLcK8bZ2ypGMsm5jZ+Cet11UXRo3RkeHUUKQvwtpateIx:CYHQyT0ff597X8bZ2ypGyQ
TLSH
T1EF063A21B247C426D66F03B1692CEE9E91386F223B6354D7B6DC3D6E1B708C21636E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1924644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW CreateEventExW WaitForSingleObject CreateProcessW GetLastError GetExitCodeProcess SetEvent RemoveDirectoryW GetProcAddress GetModuleHandleW GetWindowsDirectoryW CreateDirectoryW GetTempPathW GetTempFileNameW MoveFileW EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW InitializeCriticalSection lstrcpynW CreateThread LoadLibraryExW GetCurrentProcess Sleep WideCharToMultiByte GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SetFileTime SystemTimeToFileTime MultiByteToWideChar GetSystemInfo WaitForMultipleObjects GetVersionExW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW LocalFree LocalAlloc SetUnhandledExceptionFilter FileTimeToSystemTime GetEnvironmentVariableW GetSystemTime GetDateFormatW GetTimeFormatW GetLocaleInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW FormatMessageW GetEnvironmentStringsW InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetSystemDefaultLangID GetUserDefaultLangID GetLocalTime ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW CreateNamedPipeW ConnectNamedPipe TerminateThread CompareFileTime CopyFileExW OpenEventW PeekNamedPipe WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetSystemTimeAsFileTime IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetFileType LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW GetProcessAffinityMask GetModuleHandleA GlobalMemoryStatus ReleaseSemaphore CreateSemaphoreW

Sharing

General

Malware Config

Signatures

File Explorer

6d0295669c0844a002c32ae5833362e38454bae0d939b9ad008478ff87964074

kernel32

generic