fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893

Sharing

Copy URL Twitter E-mail

General

Target
fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893
Size 1.0MB
Sample261002-m2bcwayz8p
SHA256 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893
MD5 e5aae38b42c8d88019c8de84e7aea7bd
SHA1 f5330eba7e9a1cd4076b27e5bac20d550825358f
SHA512 d7f7a984852d1efd06bea751e37ad475394676d99cbb47521606d82df2e64331e8a1531f2463d409e46ab3016d43ea2fd5e91e68ed5b906f953bf5fe9c6e61cf
SSDEEP 24576:0U+hmWaC4+6GSk8HPEgUegXLie0rrSCKHlXw:0vJ4+6GSk8HPLUegXLih
TLSH
T11735295BE2B345ECC52FC074C7629772BA70B82946347D2E1E94E7326F21E509B2E724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893

File Explorer

fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893

.exe 1.0MB

fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893

IMPHASH f93fc43c7b094c0c8125395270b546f0
SHA256 fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893
MD5 e5aae38b42c8d88019c8de84e7aea7bd
SHA1 f5330eba7e9a1cd4076b27e5bac20d550825358f
SHA512 d7f7a984852d1efd06bea751e37ad475394676d99cbb47521606d82df2e64331e8a1531f2463d409e46ab3016d43ea2fd5e91e68ed5b906f953bf5fe9c6e61cf
SSDEEP 24576:0U+hmWaC4+6GSk8HPEgUegXLie0rrSCKHlXw:0vJ4+6GSk8HPLUegXLih
TLSH
T11735295BE2B345ECC52FC074C7629772BA70B82946347D2E1E94E7326F21E509B2E724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegEnumKeyExA RegOpenKeyExA RegQueryValueExA

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler CloseHandle CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FindNextFileA FlushInstructionCache FormatMessageA GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetDiskFreeSpaceExA GetFileAttributesA GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetThreadContext GetThreadId GetTickCount64 GlobalMemoryStatusEx InitializeConditionVariable InitializeCriticalSection LeaveCriticalSection LocalFree MultiByteToWideChar Process32FirstW Process32NextW ProcessIdToSessionId QueryPerformanceCounter QueryPerformanceFrequency RaiseException RemoveVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCP SetConsoleOutputCP SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-conio-l1-1-0

_getwch

api-ms-win-crt-convert-l1-1-0

mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _fileno _fseeki64 _ftelli64 _lseeki64 _read _wfopen _write fclose fflush fopen fputc fputs fread fwrite getc getwc putc putwc setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_wcsicmp iswctype memset strcmp strcoll strlen strncmp strxfrm tolower towlower towupper wcscoll wcslen wcsxfrm

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset strftime wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

SHGetFolderPathA

user32

GetCursorPos GetSystemMetrics

winmm

waveInGetNumDevs

Name

.text

Size

821KB

Virtual Size

821KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fda1f46ea966f0be3d2037e36f94cfbeb82d08bbd8aba665ef6de5afaafa4893

advapi32

iphlpapi

kernel32

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

shell32

user32

winmm

generic