f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f

Sharing

Copy URL Twitter E-mail

General

Target
f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f
Size 3.2MB
Sample261002-e9m3msvfqc
SHA256 f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f
MD5 fcb5f2aeb3383f6182e9c8b44a2b42ea
SHA1 ec24d888edcb4d72b1d79852ce182047c884170a
SHA512 dc7608892cf331c7310bead2a0a1955fcf9b620e019e424b35589840742ad28dc6c22b474e1973dca51ed1628bd7e8adecdd56294b440571f0f840ada5c0a89e
SSDEEP 49152:g6Vrvcn7WwFN99g8I0SslPZnrQk0b/Of9tSAjyvEONSCt578ATi1XhvB/U6dLAX0:Dgz9dNU6dLAUHk5c8RZJ+d0MwRdERr
TLSH
T151E55C03FF861CA7DACB67B474C362312738BC5196D96B2B3648C630B9035D16F5AB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f

File Explorer

f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f

.exe 3.2MB

f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f

IMPHASH 343cdb33293174f85bd3746612799e76
SHA256 f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f
MD5 fcb5f2aeb3383f6182e9c8b44a2b42ea
SHA1 ec24d888edcb4d72b1d79852ce182047c884170a
SHA512 dc7608892cf331c7310bead2a0a1955fcf9b620e019e424b35589840742ad28dc6c22b474e1973dca51ed1628bd7e8adecdd56294b440571f0f840ada5c0a89e
SSDEEP 49152:g6Vrvcn7WwFN99g8I0SslPZnrQk0b/Of9tSAjyvEONSCt578ATi1XhvB/U6dLAX0:Dgz9dNU6dLAUHk5c8RZJ+d0MwRdERr
TLSH
T151E55C03FF861CA7DACB67B474C362312738BC5196D96B2B3648C630B9035D16F5AB4A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject Ellipse RoundRect SelectObject SetBkMode SetTextColor

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindAtomA GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetHandleInformation GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetStartupInfoW GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

__C_specific_handler ___lc_codepage_func __dllonexit __iob_func __lconv_init __mb_cur_max __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _beginthreadex _cexit _endthreadex _errno _fmode _ftime _initterm _lock _onexit _setjmp _strnicmp _unlock _wcmdln _write abort calloc exit fprintf fputc fputs fputwc free fwrite getenv isspace iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset printf realloc setlocale signal sprintf strcmp strcoll strerror strftime strlen strncmp strxfrm towlower towupper vfprintf wcscoll wcsftime wcslen wcsxfrm

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetCursorPos GetDC GetMessageW InvalidateRect LoadCursorW LoadIconW PostQuitMessage PtInRect RegisterClassExW ReleaseDC ScreenToClient SetCursor ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

450KB

Virtual Size

449KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/105

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f6f92861e812ad82be6f82e16d07a4aad550ce5249bd921ae122467fbfda854f

comctl32

gdi32

kernel32

msvcrt

user32

generic