e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2

General

Target
e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2
Size 163KB
Sample261002-e65hhsxzby
SHA256 e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2
MD5 4cccae7e78e9a8e6c40b096a56c741aa
SHA1 45371e258f95590252e67fb2e60cb6b0a54275b9
SHA512 d0d3ec0a6584bb97064a22b5834494480f406b543acb314507336a3f8f8f6858f25bc7abcd34b2737263a987cfd2357f77e97b06f436288c07ba3dc4c59e4f7d
SSDEEP 3072:HoFkOkrBjxkl7n26TzMttk7geh65jmwSfI8Hx5c:HoFcJGlD2oatUgehTR5
TLSH
T1FCF36C57B3A900BBE4779239C9A30606E772781507209BEF039447BA6F677D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2

File Explorer

e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2

.dll 163KB

e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2

IMPHASH 9d067e51d158eb5b6b49f52cefbb6f0e
SHA256 e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2
MD5 4cccae7e78e9a8e6c40b096a56c741aa
SHA1 45371e258f95590252e67fb2e60cb6b0a54275b9
SHA512 d0d3ec0a6584bb97064a22b5834494480f406b543acb314507336a3f8f8f6858f25bc7abcd34b2737263a987cfd2357f77e97b06f436288c07ba3dc4c59e4f7d
SSDEEP 3072:HoFkOkrBjxkl7n26TzMttk7geh65jmwSfI8Hx5c:HoFcJGlD2oatUgehTR5
TLSH
T1FCF36C57B3A900BBE4779239C9A30606E772781507209BEF039447BA6F677D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ole32

StringFromGUID2 CLSIDFromString CoTaskMemFree

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteTreeW RegCloseKey RegSetValueExW RegCreateKeyExW

shell32

SHGetKnownFolderPath

kernel32

WriteConsoleW FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers CreateDirectoryW CreateFileW ReadFile WriteFile OutputDebugStringW CloseHandle GetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentProcessId GetCurrentThreadId GetLocalTime DisableThreadLibraryCalls GetModuleFileNameW MoveFileExW WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent OpenMutexW CreateEventW OpenEventW GetTickCount GetTickCount64 CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateTimerQueueTimer DeleteTimerQueueTimer WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead HeapReAlloc RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedFlushSList SetLastError FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetFilePointerEx GetStringTypeW SetStdHandle HeapSize

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e16ae5f26182b58be919c1f7a386c7c7465701f1f9f0a911c27f903fa5dc82f2

ole32

advapi32

shell32

kernel32

generic