b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7

Sharing

Copy URL Twitter E-mail

General

Target
b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7
Size 612KB
Sample260930-ykv7hatdkf
SHA256 b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7
MD5 30548f9f2d090cf02cc8fb2908d3ac87
SHA1 041e6eb31f1a8a4209b2f107b61ba1b5b32925cf
SHA512 71b8eb2718408bd14c4d2597d06ca31dea1683d46e4b90a42160ee39696f22ee4eb48687c2abd77dcf5aae100266775921ff71f0f212496ba92c00d6e4f5e4c2
SSDEEP 6144:ZBIlikeCYu1ID0XYpk4/umyu/Wn9S5xKwhjV:ZBIlbehmIAXYpk4iW7Kwhp
TLSH
T194D4869523F49E52F562833858F3A3303739B951AB52CB0F85007A2D1D37BD16F96B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7

File Explorer

b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7

.exe 612KB

b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7

IMPHASH 7cd522002211caa49bfedb27da1ea60f
SHA256 b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7
MD5 30548f9f2d090cf02cc8fb2908d3ac87
SHA1 041e6eb31f1a8a4209b2f107b61ba1b5b32925cf
SHA512 71b8eb2718408bd14c4d2597d06ca31dea1683d46e4b90a42160ee39696f22ee4eb48687c2abd77dcf5aae100266775921ff71f0f212496ba92c00d6e4f5e4c2
SSDEEP 6144:ZBIlikeCYu1ID0XYpk4/umyu/Wn9S5xKwhjV:ZBIlbehmIAXYpk4iW7Kwhp
TLSH
T194D4869523F49E52F562833858F3A3303739B951AB52CB0F85007A2D1D37BD16F96B2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegQueryValueW RegSetValueExW

comctl32

CreateStatusWindowW CreateToolbarEx ImageList_Destroy ImageList_DrawEx ImageList_LoadImageW InitCommonControlsEx

comdlg32

ChooseFontW CommDlgExtendedError

gdi32

CreateFontIndirectW CreateFontW CreateRectRgn CreateRectRgnIndirect CreateSolidBrush DeleteObject ExtSelectClipRgn GetClipRgn GetDeviceCaps GetObjectW GetStockObject GetTextExtentPoint32W LineTo MoveToEx Rectangle SelectClipRgn SelectObject SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CreateFileW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FormatMessageW GetCommandLineW GetCurrentDirectoryW GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetLogicalDriveStringsW GetModuleHandleW GetNumberFormatW GetProcAddress GetStartupInfoW GetTimeFormatW GetVolumeInformationW GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree LocalFree MulDiv MultiByteToWideChar SetCurrentDirectoryW SetErrorMode lstrcmpW lstrcmpiW

mpr

WNetConnectionDialog WNetDisconnectDialog WNetGetLastErrorW

ole32

CoGetMalloc CoInitialize CoUninitialize

shell32

ord18 ord25 ExtractIconExW SHBindToParent SHFileOperationW SHGetDataFromIDListW SHGetDesktopFolder ShellAboutW ShellExecuteExW ShellExecuteW

shlwapi

StrFormatByteSizeW

ucrtbase

__p___argc __p___wargv __stdio_common_vswprintf _assert _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _wsplitpath exit memcmp memcpy memmove qsort setlocale tolower wcsrchr

user32

BeginDeferWindowPos BeginPaint CallNextHookEx CallWindowProcW CharUpperW CheckMenuItem CreatePopupMenu CreateWindowExW DefFrameProcW DefMDIChildProcW DeferWindowPos DestroyIcon DestroyWindow DialogBoxParamW DispatchMessageW DrawIconEx DrawTextW EndDeferWindowPos EndDialog EndPaint FillRect GetCapture GetClientRect GetCursorPos GetDC GetDlgItem GetFocus GetKeyState GetMenuItemCount GetMessageW GetParent GetScrollPos GetSubMenu GetSystemMetrics GetWindow GetWindowInfo GetWindowLongPtrW GetWindowPlacement GetWindowRect GetWindowTextW InvalidateRect IsIconic IsWindowVisible IsZoomed LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW MapWindowPoints MessageBoxW MoveWindow PostQuitMessage RedrawWindow RegisterClassExW RegisterClassW RegisterClipboardFormatW ReleaseCapture ReleaseDC ScreenToClient ScrollWindowEx SendMessageW SetCapture SetCursor SetDlgItemTextW SetFocus SetWindowLongPtrW SetWindowPlacement SetWindowTextW SetWindowsHookExW ShowWindow TrackPopupMenu TranslateAcceleratorW TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UpdateWindow WinHelpW wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

64KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

228KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b862e4537988cd50be718d543e38061e82f030b5855bd6f415b44207f809adc7

advapi32

comctl32

comdlg32

gdi32

kernel32

mpr

ole32

shell32

shlwapi

ucrtbase

user32

version

generic