7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06

Sharing

Copy URL Twitter E-mail

General

Target
7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06
Size 664KB
Sample261003-r1wpmsdg37
SHA256 7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06
MD5 ce20d051c13c23edcc9bd180873accb9
SHA1 97fb3f7e8c7531eb04cd94f9e81501d05121bbb2
SHA512 5014aac8edcb10deb0c7d3655efe4556b60e4757efa403dc65b3d5579e2093110efe3ed4a4bd2a8168132bc4bcea4f12c1f8a87752267e501258fc3c28baaec2
SSDEEP 12288:eYNT29g03FHHsbd89K4/LpABW0EDVRQbioxfeAcnCG5:eYNTjcqio4AB
TLSH
T11CE45005A7FADD05F5F76F3859FA43E41A7ABD61AE30C60E9A08214E18B1E50DE34723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06

File Explorer

7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06

.exe 664KB

7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06

IMPHASH 6ef45c865c4822e49ec649f1daa7c769
SHA256 7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06
MD5 ce20d051c13c23edcc9bd180873accb9
SHA1 97fb3f7e8c7531eb04cd94f9e81501d05121bbb2
SHA512 5014aac8edcb10deb0c7d3655efe4556b60e4757efa403dc65b3d5579e2093110efe3ed4a4bd2a8168132bc4bcea4f12c1f8a87752267e501258fc3c28baaec2
SSDEEP 12288:eYNT29g03FHHsbd89K4/LpABW0EDVRQbioxfeAcnCG5:eYNTjcqio4AB
TLSH
T11CE45005A7FADD05F5F76F3859FA43E41A7ABD61AE30C60E9A08214E18B1E50DE34723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65545

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtSetSystemPowerState NtShutdownSystem RtlNtStatusToDosError

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetSecurityInfo GetTokenInformation GetUserNameW LookupAccountSidW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

CreateStatusWindowW ImageList_Create ImageList_Remove ImageList_ReplaceIcon InitCommonControls

kernel32

CloseHandle CreateEventW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FormatMessageW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetLastError GetLocaleInfoW GetModuleHandleA GetModuleHandleW GetNumberFormatW GetPriorityClass GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessIoCounters GetStartupInfoW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree OpenProcess Process32FirstW Process32NextW QueryDosDeviceW QueryPerformanceCounter ReadProcessMemory SetPriorityClass SetProcessAffinityMask SetProcessShutdownParameters SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject lstrlenW

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snwprintf _ultow _unlock _vsnwprintf _wcmdln _wcsicmp _wcsnicmp abort calloc exit free fwrite malloc memmove signal strncmp vfprintf wcscat wcschr wcscmp wcscpy wcslen wcsncpy wcsstr

shell32

ShellAboutW ShellExecuteExW ShellExecuteW Shell_NotifyIconW

shlwapi

StrFormatByteSizeW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreatePen CreateSolidBrush DeleteDC DeleteObject ExcludeClipRect ExtTextOutW GetStockObject LineTo MoveToEx RestoreDC SaveDC SelectObject SetBkColor SetTextColor

user32

AppendMenuW BeginPaint BringWindowToTop CallWindowProcW CascadeWindows CharUpperW CheckDlgButton CheckMenuItem CheckMenuRadioItem CreateDialogParamW CreateIconIndirect CreatePopupMenu DefWindowProcW DeleteMenu DestroyIcon DestroyMenu DialogBoxParamW DispatchMessageW DrawMenuBar DrawTextW EnableMenuItem EnableWindow EndDialog EndPaint EndTask EnumDisplaySettingsW EnumWindows ExitWindowsEx FillRect FindWindowW GetAsyncKeyState GetClassLongW GetClientRect GetCursorPos GetDC GetDlgItem GetGuiResources GetKeyState GetMenu GetMenuItemCount GetMenuState GetMenuStringW GetMessageW GetParent GetShellWindow GetSubMenu GetSystemMetrics GetWindow GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId InflateRect InsertMenuW InvalidateRect IsDlgButtonChecked IsWindow IsWindowVisible IsZoomed KillTimer LoadBitmapW LoadIconW LoadMenuW LoadStringW LockWorkStation MapWindowPoints MessageBoxW ModifyMenuW MoveWindow OpenIcon PeekMessageW PostMessageW PostThreadMessageW ReleaseDC RemoveMenu SendMessageTimeoutW SendMessageW SetFocus SetForegroundWindow SetMenuDefaultItem SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow ShowWindowAsync SwitchToThisWindow TileWindows TrackPopupMenu TrackPopupMenuEx TranslateMessage wsprintfW

Name

.text

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

484KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7858d19d9ca999ef83f4437874bb8920867412578e4b11fa15e80514b2466b06

ntdll

advapi32

comctl32

kernel32

msvcrt

shell32

shlwapi

gdi32

user32

generic