687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454

Sharing

Copy URL Twitter E-mail

General

Target
687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454
Size 794KB
Sample261004-pg46kaag42
SHA256 687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454
MD5 2e28d51586b762f34e71a56a64bedb32
SHA1 9388214a1d68a2831b330d61685576ee0e3693b4
SHA512 f185b46d791127b6dfce6ffd7deba10dc1baa71d2c166608a9ed007d08a30e3c87f1521bb9bd0a99c52d6374bf29b77e5ecbb2517cf00ed241bdc5c0487796ff
SSDEEP 12288:zH4q/W7id7BUm5rKfq3wAFFumGoDzAqrhYRP8XAMk8rH4qfvb:zHRe7i7UImkvjgR8A0rHRfvb
TLSH
T15C05D083368AC475C5980631AC43C7B625A26EA2AF53A0D777D1BF3F3C789A09957343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454

File Explorer

687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454

.exe 794KB

687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454

IMPHASH a1291a5d91e60fb83fda0c86214ecc97
SHA256 687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454
MD5 2e28d51586b762f34e71a56a64bedb32
SHA1 9388214a1d68a2831b330d61685576ee0e3693b4
SHA512 f185b46d791127b6dfce6ffd7deba10dc1baa71d2c166608a9ed007d08a30e3c87f1521bb9bd0a99c52d6374bf29b77e5ecbb2517cf00ed241bdc5c0487796ff
SSDEEP 12288:zH4q/W7id7BUm5rKfq3wAFFumGoDzAqrhYRP8XAMk8rH4qfvb:zHRe7i7UImkvjgR8A0rHRfvb
TLSH
T15C05D083368AC475C5980631AC43C7B625A26EA2AF53A0D777D1BF3F3C789A09957343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

277299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

dbghelp

ImageNtHeader

kernel32

LCMapStringA SetStdHandle WriteConsoleA GetStringTypeA QueryPerformanceCounter GetStringTypeW GetLocaleInfoA CompareStringA CompareStringW SetEndOfFile InitializeCriticalSectionAndSpinCount Sleep GetLastError WriteFile ReadFile GetProcAddress LoadLibraryA GetUserDefaultLCID CloseHandle CreateFileA CreateDirectoryA GetLongPathNameW ExitProcess RemoveDirectoryA FindClose FindNextFileA DeleteFileA FindFirstFileA WideCharToMultiByte MultiByteToWideChar AreFileApisANSI FindFirstFileW GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GetWindowsDirectoryA GetLongPathNameA GetEnvironmentVariableA GetTempPathA GetWindowsDirectoryW GetEnvironmentVariableW GetTempPathW GetTempFileNameA GetFullPathNameW GetFullPathNameA FreeEnvironmentStringsW GetEnvironmentStringsW FreeEnvironmentStringsA GetEnvironmentStrings GetConsoleOutputCP DuplicateHandle GetCurrentProcess TerminateProcess GetExitCodeProcess WaitForSingleObject CreateProcessA SetEnvironmentVariableA SearchPathA EnterCriticalSection InitializeCriticalSection LeaveCriticalSection GetCurrentProcessId GetProcessHeap GetMailslotInfo CreateThread CreateMailslotA GetOverlappedResult CancelIo CreateEventA GetCommandLineW CreateSemaphoreA SizeofResource LockResource LoadResource FindResourceA GetTickCount AllocConsole GetModuleHandleA CreateProcessW SetCurrentDirectoryW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetSystemTimeAsFileTime CreateDirectoryW RemoveDirectoryW HeapAlloc HeapFree WriteConsoleW GetFileType GetStdHandle GetCommandLineA GetStartupInfoA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers DeleteCriticalSection SetHandleCount VirtualFree VirtualAlloc HeapReAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW LoadLibraryW SetEnvironmentVariableW GetTimeZoneInformation GetFileAttributesW

Name

.text

Size

340KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/17

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

687e113385f3fabe570a8c0637a81df27ef7497a0e7988e06e268f98ad840454

dbghelp

kernel32

generic