5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3

Sharing

Copy URL Twitter E-mail

General

Target
5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3
Size 367KB
Sample261002-e65hhshb25
SHA256 5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3
MD5 d7958677f6e884e14becf105134d54d0
SHA1 5cad4610a1606fffb70a6a0ba9026559ea7c2f6f
SHA512 dcfa293115c8d1af69d3ede1665e931456340659a9cc27c11a1fef8184a5d254cb55d9787607f70c3f5dd0895aee6129c5f03359b686cdfb25301626f71d28bc
SSDEEP 6144:ihvCxemDhPchp2gKuOEXVwMmExcQBqopXt5aWgdW:ihvCx9D9chpo0wXccoddpgdW
TLSH
T1C3846D15DFA800FDE1B7D6B4CE768941D6727C4B0B71DAEB239049552E23A908E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3

File Explorer

5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3

.exe 367KB

5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3

IMPHASH 2ed495d6b1e69f04d09412193e2149bb
SHA256 5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3
MD5 d7958677f6e884e14becf105134d54d0
SHA1 5cad4610a1606fffb70a6a0ba9026559ea7c2f6f
SHA512 dcfa293115c8d1af69d3ede1665e931456340659a9cc27c11a1fef8184a5d254cb55d9787607f70c3f5dd0895aee6129c5f03359b686cdfb25301626f71d28bc
SSDEEP 6144:ihvCxemDhPchp2gKuOEXVwMmExcQBqopXt5aWgdW:ihvCx9D9chpo0wXccoddpgdW
TLSH
T1C3846D15DFA800FDE1B7D6B4CE768941D6727C4B0B71DAEB239049552E23A908E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102988

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

SetThreadDesktop CloseDesktop GetThreadDesktop GetProcessWindowStation GetUserObjectInformationW CreateDesktopW

advapi32

DuplicateTokenEx ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW RegQueryValueExW RegOpenKeyExW CreateProcessAsUserW OpenProcessToken CreateWellKnownSid SetTokenInformation RegCloseKey

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

kernel32

SetFilePointerEx HeapSize HeapReAlloc WriteConsoleW Process32NextW GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW ReadFile RemoveDirectoryW WriteFile GetTempPathW OutputDebugStringW CloseHandle DuplicateHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObject CreateMutexW OpenMutexW CreateMutexExW Sleep GetProcessTimes GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateThread GetCurrentThreadId CreateProcessW ProcessIdToSessionId OpenProcess GetSystemTimeAsFileTime GetLocalTime GetTickCount64 GetModuleFileNameW QueryUnbiasedInterruptTime LocalFree MoveFileExW WTSGetActiveConsoleSessionId WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead GetOEMCP RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress GetStdHandle GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

Name

.text

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5faa684d323a38eab902ea3fd00aab420652f7c1b28de6b67710643e8e4657d3

user32

advapi32

wtsapi32

userenv

ole32

shell32

kernel32

generic