fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb

Sharing

Copy URL Twitter E-mail

General

Target
fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb
Size 2.8MB
Sample261002-lmnh8afa85
SHA256 fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb
MD5 1f3a6111a9defedef99c76ab0b62d8f3
SHA1 e0ac679fb17e21d47b0812129a222c3af5e19db0
SHA512 a78a229b8e4531a131dee193372cd190d766e99ed54acbd5741a66ff7caf5b51728261d624752aa2d3a3f2afd5a8680d789d28d30d80bf1bea672827b3d7adca
SSDEEP 49152:/jqPeMprQMRm12dUV+lGJ6Yd5+rWV6sCOfx2EwCKG+qsaitwCBGDBue+wkfSwAeb:7ZSrQMRm12dUV+lYdGOfx2EwFQhNfeRF
TLSH
T180D5AE217A41C036EAA201719C7CFFAE449CE6640F2545EB63DC0B7F6E306D35A35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb

File Explorer

fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb

.exe 2.8MB

fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb

IMPHASH 8112cfcc2ccd3aac7be83cf282f4a06a
SHA256 fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb
MD5 1f3a6111a9defedef99c76ab0b62d8f3
SHA1 e0ac679fb17e21d47b0812129a222c3af5e19db0
SHA512 a78a229b8e4531a131dee193372cd190d766e99ed54acbd5741a66ff7caf5b51728261d624752aa2d3a3f2afd5a8680d789d28d30d80bf1bea672827b3d7adca
SSDEEP 49152:/jqPeMprQMRm12dUV+lGJ6Yd5+rWV6sCOfx2EwCKG+qsaitwCBGDBue+wkfSwAeb:7ZSrQMRm12dUV+lYdGOfx2EwFQhNfeRF
TLSH
T180D5AE217A41C036EAA201719C7CFFAE449CE6640F2545EB63DC0B7F6E306D35A35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1253139

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AacDramHal\ASUS\Aac3572DramHal_x86.pdb

kernel32

FormatMessageW SetProcessMitigationPolicy GetFileAttributesW GetFileAttributesExW LocalFree GetCurrentDirectoryW GetFileSize WriteConsoleW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA ResetEvent SetEvent OutputDebugStringW CreateEventW OutputDebugStringA FreeLibrary GetSystemDirectoryW GetModuleFileNameW SetFileAttributesA DeleteFileA CreateFileA WriteFile CloseHandle ReleaseMutex WaitForSingleObject CreateMutexW GetModuleFileNameA DeleteCriticalSection DecodePointer RaiseException GetLastError InitializeCriticalSectionEx WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetShortPathNameA GetModuleHandleA GetProcAddress LoadLibraryW SetLastError Sleep GetOEMCP GetACP IsValidCodePage HeapReAlloc SetConsoleCtrlHandler SetStdHandle GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc FlushFileBuffers GetFileSizeEx HeapAlloc HeapFree GetStdHandle ExitProcess CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileInformationByHandle SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CopyFileW CreateHardLinkW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetNativeSystemInfo EncodePointer GetStringTypeW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlUnwind ReadFile ExitThread ResumeThread GetModuleHandleExW SetEnvironmentVariableW SetCurrentDirectoryW GetFileType GetConsoleMode ReadConsoleW GetConsoleOutputCP GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFullPathNameW RemoveDirectoryW MoveFileExW DeleteFileW RtlCaptureStackBackTrace

user32

GetMessageW UnregisterClassW TranslateMessage DispatchMessageW MessageBoxA

advapi32

GetAce EqualSid AllocateAndInitializeSid SetNamedSecurityInfoW GetNamedSecurityInfoW DeleteAce FreeSid BuildTrusteeWithSidW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegNotifyChangeKeyValue SetSecurityDescriptorDacl InitializeSecurityDescriptor RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegQueryValueExA RegCreateKeyExA RegFlushKey RegSetValueExW RegSetValueExA RegQueryInfoKeyA RegOpenKeyExA RegEnumValueA RegDeleteValueA RegSaveKeyA RegQueryValueExW RegEnumKeyExA

shell32

ShellExecuteA SHCreateDirectoryExW

ole32

CoRegisterClassObject CoUninitialize StringFromCLSID CoTaskMemFree CoRevokeClassObject CoInitializeEx

oleaut32

SafeArrayCreateVector SafeArrayPutElement UnRegisterTypeLi LoadTypeLi LoadTypeLibEx SysAllocString SafeArrayUnaccessData SafeArrayAccessData VariantInit

shlwapi

PathIsDirectoryW PathFileExistsA

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

296KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

669KB

Virtual Size

672KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fadabc46b8597c7f6ed94f8fa86ecb6b3df6ebf2abde6ad24f0e332baabd08eb

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic