eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb

General

Target
eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb
Size 148KB
Sample260930-pwty5sydqa
SHA256 eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb
MD5 127a9c6f940530c740b8fe2607e1a677
SHA1 53707932c66cb18faebf72b26c48208c68675eb0
SHA512 93a10ede59e27cc277183b6868bd6ff7d62d50b4d1bc14970ed5d1ea5ce82cfce3714256bd38f86147b2375539f45fd895d107c7134aa373871bdbb9056cae6e
SSDEEP 1536:Ph7KiDDe8awLX88ugoK4B+Rwd/NHhxHx5vcMBC:ZG01awpoKMa8/NHhxHx50MBC
TLSH
T111E353111BED98F4E17A8FF509B79F920E7538030BE482DF1B64D54C2CB5AD0AAB4396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb

File Explorer

eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb

.dll 148KB

eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb

IMPHASH 28d6a63be11028d6860294d33fb1dea9
SHA256 eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb
MD5 127a9c6f940530c740b8fe2607e1a677
SHA1 53707932c66cb18faebf72b26c48208c68675eb0
SHA512 93a10ede59e27cc277183b6868bd6ff7d62d50b4d1bc14970ed5d1ea5ce82cfce3714256bd38f86147b2375539f45fd895d107c7134aa373871bdbb9056cae6e
SSDEEP 1536:Ph7KiDDe8awLX88ugoK4B+Rwd/NHhxHx5vcMBC:ZG01awpoKMa8/NHhxHx50MBC
TLSH
T111E353111BED98F4E17A8FF509B79F920E7538030BE482DF1B64D54C2CB5AD0AAB4396
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

18192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

comctl32

ord413 InitCommonControls ord412 ord410

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow

advapi32

CredEnumerateW CredFree CredWriteW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp free fwrite getenv memcpy memmove memset strchr strcmp strcpy strcspn strlen wcschr wcslen wcsrchr

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar RaiseException SizeofResource lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

792B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eaa0e1d30c37d38bc49a5bdd9f8fd88648f9c20ff0c7ba45dd612e936ebd89bb

comctl32

user32

advapi32

ucrtbase

kernel32

ntdll

generic