e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a

General

Target
e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a
Size 3.1MB
Sample261002-hp6k2athja
SHA256 e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a
MD5 dc875b5a8224bd78021e49acc575e905
SHA1 bdd313c9f020551a9da19bad1f3a3be1c0427b59
SHA512 52c9cb9a7dc53d4bb411ff57d157cb7d2b4412b902731fd5d742457ff8402b1f2e6ca1ba3e8baa7a26cfa154d5439995860973cabce0e624989048699d4b2a3e
SSDEEP 49152:3c1Qc6Ex/3nwAw022brq1FCq9etCNukHEk1HzOUO3V:Mx6cnwAXrK/eQNVHvz1+
TLSH
T17BE59D23A112A8D2C5257BFA66E5132C3DB497642C79CC67EEF84D62BC71833876384D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a

File Explorer

e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a

.exe 3.1MB

e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a

IMPHASH ff1cadd9803a09df80620788b5315ba1
SHA256 e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a
MD5 dc875b5a8224bd78021e49acc575e905
SHA1 bdd313c9f020551a9da19bad1f3a3be1c0427b59
SHA512 52c9cb9a7dc53d4bb411ff57d157cb7d2b4412b902731fd5d742457ff8402b1f2e6ca1ba3e8baa7a26cfa154d5439995860973cabce0e624989048699d4b2a3e
SSDEEP 49152:3c1Qc6Ex/3nwAw022brq1FCq9etCNukHEk1HzOUO3V:Mx6cnwAXrK/eQNVHvz1+
TLSH
T17BE59D23A112A8D2C5257BFA66E5132C3DB497642C79CC67EEF84D62BC71833876384D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

MessageBoxA

kernel32

WriteConsoleW GetTempPathA GetProcAddress LoadResource LockResource SizeofResource LoadLibraryA FindResourceA SetEndOfFile QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsDebuggerPresent UnhandledExceptionFilter HeapFree CloseHandle DecodePointer GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap CreateFileW FlushFileBuffers ReadFile ReadConsoleW HeapSize HeapReAlloc

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e70d4b823b48ad4d420ef11a176a51b03ba7cef077f93e4825c68fa6ad45729a

user32

kernel32

generic