5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd

Sharing

Copy URL Twitter E-mail

General

Target
5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd
Size 814KB
Sample260930-v5fe1a1scv
SHA256 5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd
MD5 5e389089d5dcfbc57db12643dbc40bd8
SHA1 08718681b6980a03e723b6e987ab972292ac100d
SHA512 33428047f8f407b1360868c9130c38a00876e528ebd3a863c6406b1f326d61883e45fe626bfb64ff3d3648e91417891f8b75e52f4f4be625ffc74b8d4524b37e
SSDEEP 12288:0rSj/2p/3XzpqTf4kuonRUFwKNvEdQu1raNM7IZZ:0rSj/2p/3Xz7k9nEl1wQu1M
TLSH
T162055D29D7594378D0369176EE420C00D73278091794DFEB66805DF27E9BB98AE3FB82
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd

File Explorer

5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd

.dll 814KB

5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd

IMPHASH 077980910e3b8097f1eb7353f264bcfd
SHA256 5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd
MD5 5e389089d5dcfbc57db12643dbc40bd8
SHA1 08718681b6980a03e723b6e987ab972292ac100d
SHA512 33428047f8f407b1360868c9130c38a00876e528ebd3a863c6406b1f326d61883e45fe626bfb64ff3d3648e91417891f8b75e52f4f4be625ffc74b8d4524b37e
SSDEEP 12288:0rSj/2p/3XzpqTf4kuonRUFwKNvEdQu1raNM7IZZ:0rSj/2p/3Xz7k9nEl1wQu1M
TLSH
T162055D29D7594378D0369176EE420C00D73278091794DFEB66805DF27E9BB98AE3FB82
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

390320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

wininet

InternetSetOptionA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpOpenRequestA

kernel32

GetConsoleMode GetConsoleOutputCP GetCommandLineW GetCurrentProcess GetModuleFileNameW GetLastError CloseHandle HeapFree DeviceIoControl GetSystemDirectoryW GetModuleHandleA CreateToolhelp32Snapshot MultiByteToWideChar GetTickCount64 Process32NextW CreateFileA Process32FirstW HeapAlloc GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte LoadLibraryExW EnterCriticalSection LeaveCriticalSection AddVectoredContinueHandler SetErrorMode Sleep AddVectoredExceptionHandler GetProcAddress SetUnhandledExceptionFilter WriteFile FlushFileBuffers HeapSize CreateFileW WriteConsoleW LoadLibraryW GetCurrentThreadId SetStdHandle SetFilePointerEx InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SetConsoleCtrlHandler ExitProcess FreeLibrary GetModuleHandleExW GetStdHandle GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

user32

wsprintfW

advapi32

AdjustTokenPrivileges OpenProcessToken GetTokenInformation LookupPrivilegeValueW

shell32

ShellExecuteExW

Name

.text

Size

506KB

Virtual Size

505KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5edbbe34d6704f62022545143fca30ba48392793eec8cf023b7c400ffb5944cd

wininet

kernel32

user32

advapi32

shell32

generic