528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1

Sharing

Copy URL Twitter E-mail

General

Target
528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1
Size 84KB
Sample261003-r8vgjs1cmd
SHA256 528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1
MD5 31bdb927927fcca5204475e0645c563a
SHA1 64448715bddb48e78dd59925a79b1d832950c0fb
SHA512 5cf3fd3bfed098f87dbeee140ba8980e72e2c54ad0ffb3dc435d3a4f5db37db49588fd16512d8807bb03dab721a68be0703cb93f0402661cac74c1a32374f211
SSDEEP 1536:Z9jodaS2zA0Hg0dGXeO2TbpjTrg91NJW8:vkwhzA0DdGuZ1jTri7W8
TLSH
T1E883C710E7E68D57E9F2273409B383E40A35FC518B31964F9BA9626F4931B10DF9272B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1

File Explorer

528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1

.dll 84KB

528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1

IMPHASH 0b884c1e489dc99ae954388f8369f2a6
SHA256 528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1
MD5 31bdb927927fcca5204475e0645c563a
SHA1 64448715bddb48e78dd59925a79b1d832950c0fb
SHA512 5cf3fd3bfed098f87dbeee140ba8980e72e2c54ad0ffb3dc435d3a4f5db37db49588fd16512d8807bb03dab721a68be0703cb93f0402661cac74c1a32374f211
SSDEEP 1536:Z9jodaS2zA0Hg0dGXeO2TbpjTrg91NJW8:vkwhzA0DdGuZ1jTri7W8
TLSH
T1E883C710E7E68D57E9F2273409B383E40A35FC518B31964F9BA9626F4931B10DF9272B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

DeleteCriticalSection EnterCriticalSection FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock _vsnwprintf abort calloc free fwrite memmove strncmp vfprintf

setupapi

CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Device_ID_Size CM_Get_Sibling CM_Request_Device_EjectW SetupDiDestroyClassImageList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetClassImageIndex SetupDiGetClassImageList pSetupGuidFromString

user32

ClientToScreen DestroyIcon DestroyMenu DialogBoxParamW EnableWindow EndDialog GetDlgItem GetSubMenu GetSystemMetrics GetWindowLongW KillTimer LoadImageW LoadMenuW LoadStringW MessageBoxW SendMessageW SetTimer SetWindowLongW SetWindowTextW TrackPopupMenu

Name

.text

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

636B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

528b6b1d5f6c152ce7d9fba28dfef43707459bd45990ef8c12e44b1b8d74e8d1

advapi32

kernel32

msvcrt

setupapi

user32

generic