abe_payload[.]dll[.]exe

General

Target
abe_payload.dll.exe
Size 109KB
Sample260930-vsqefa1t7k
SHA256 7249645e4a67c27fdfc0bafc578738317a32f77dde58db036bf74188b51a4623
MD5 20d09bfdd9a3f457c2ff6b4f66d0c13c
SHA1 dffd87ed6bfbca6b82cd3151e4b848f83f65aee4
SHA512 ea7a69106197e02cb1647615cc3a18370bea43fe9db476d1a1eba2acc194286307dd2bedc4259e743ea29d32a0982da2defbbf53f7dbd629ccb6a9e454260110
SSDEEP 3072:6Ax7yEdGkuVmdL5fPBFOJ+AslhBQpmGoXUXO5YS:DdhJdNBAJHss8crS
TLSH
T18FB34B5BA2F900BBE57782B885A30A06D7B2B81147619FEF03A0425E1F237D54D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
abe_payload.dll.exe

File Explorer

abe_payload.dll.exe

.dll 109KB

abe_payload.dll.exe

IMPHASH 89296c5b402d8b12eb7880b1d597eed6
SHA256 7249645e4a67c27fdfc0bafc578738317a32f77dde58db036bf74188b51a4623
MD5 20d09bfdd9a3f457c2ff6b4f66d0c13c
SHA1 dffd87ed6bfbca6b82cd3151e4b848f83f65aee4
SHA512 ea7a69106197e02cb1647615cc3a18370bea43fe9db476d1a1eba2acc194286307dd2bedc4259e743ea29d32a0982da2defbbf53f7dbd629ccb6a9e454260110
SSDEEP 3072:6Ax7yEdGkuVmdL5fPBFOJ+AslhBQpmGoXUXO5YS:DdhJdNBAJHss8crS
TLSH
T18FB34B5BA2F900BBE57782B885A30A06D7B2B81147619FEF03A0425E1F237D54D3EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysStringByteLen SysAllocStringByteLen

user32

wsprintfA

kernel32

TerminateProcess WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle HeapReAlloc CreateFileA CreateFileW DeleteFileA FindClose FindFirstFileA FindNextFileA ReadFile WriteFile GetTempPathA CloseHandle Sleep CreateThread DisableThreadLibraryCalls MultiByteToWideChar QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW HeapSize RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW

Name

.text

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

abe_payload.dll.exe

ole32

oleaut32

user32

kernel32

generic