3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1

General

Target
3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1
Size 294KB
Sample261002-e65hhsvy7m
SHA256 3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1
MD5 649f9ce9c5f20edd3f8b5d6e52838b81
SHA1 a1f70fa9df5acf7e07aeacfc439bfd3d12042da2
SHA512 c3c795979b37fa8894073f2a8a967bfd00c4646eeebe25ab0ed0a7a731305be0b524fe89be9ae8fe64e68e9d88f84c55496d81aa7a2786b350ee37d093882f10
SSDEEP 6144:YlpqxcGIYTQ9yBoCT4tQeHJH8Tj2wg1iNZ+f:2lYruhOHg4NE
TLSH
T164547C1AE7A510BDE1B7C53DCE934941EBF2784607A0DADF079049B22E677E04B3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1

File Explorer

3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1

.dll 294KB

3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1

IMPHASH 1ed6abea3d8d6829a85507f9df70b7f4
SHA256 3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1
MD5 649f9ce9c5f20edd3f8b5d6e52838b81
SHA1 a1f70fa9df5acf7e07aeacfc439bfd3d12042da2
SHA512 c3c795979b37fa8894073f2a8a967bfd00c4646eeebe25ab0ed0a7a731305be0b524fe89be9ae8fe64e68e9d88f84c55496d81aa7a2786b350ee37d093882f10
SSDEEP 6144:YlpqxcGIYTQ9yBoCT4tQeHJH8Tj2wg1iNZ+f:2lYruhOHg4NE
TLSH
T164547C1AE7A510BDE1B7C53DCE934941EBF2784607A0DADF079049B22E677E04B3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

85356

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

user32

GetWindowThreadProcessId GetForegroundWindow GetAsyncKeyState MapVirtualKeyW GetKeyNameTextW

kernel32

SetLastError WriteConsoleW GetConsoleMode GetConsoleOutputCP ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetPrivateProfileStringW CloseHandle GetLastError CreateMutexW GetCurrentProcessId CreateThread DisableThreadLibraryCalls GetModuleFileNameW GetModuleHandleW GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualProtect Sleep GetTickCount64 TryAcquireSRWLockExclusive ReleaseMutex WaitForSingleObject VirtualQuery CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileSizeEx ReadFile WriteFile GetLocalTime MoveFileExW MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetProcessHeap GetStringTypeW SetFilePointerEx SetStdHandle HeapSize HeapReAlloc

Name

.text

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3c497fd1f4f58cf174f62d4ef8989d694b0a8aaf762f7a53d63878a337ec83e1

user32

kernel32

generic