def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561

General

Target
def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561
Size 311KB
Sample261006-prskhsbt2p
SHA256 def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561
MD5 b7517ae53af3ef647d1c2481699de1f8
SHA1 f5b6dde38796017d643e59ca471a97e09aa07e16
SHA512 0decd9c2a0ba3ce4936bf96790cccee46d4a717ed7c56fd4ff67e5cfb263a6850c0048c63a3a98b7e45e50de35eba299a8e2994633e88ad00741646acf335513
SSDEEP 3072:S2vErT4a3De0+tDkGJsxxzL06/nIRWv7UuJKbekUMKGqiRetwuHZbUm7yD35keFQ:IDe0+tDkZe2vwuIekURGqaet9SQ
TLSH
T10664171776620AD7C97AE03C4A8B6515F7B0B8A04770A7CF22B1027D4F677F99E7A201
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561

File Explorer

def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561

.dll 311KB

def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561

IMPHASH 739c850ed96273dd9171b0979123c8f3
SHA256 def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561
MD5 b7517ae53af3ef647d1c2481699de1f8
SHA1 f5b6dde38796017d643e59ca471a97e09aa07e16
SHA512 0decd9c2a0ba3ce4936bf96790cccee46d4a717ed7c56fd4ff67e5cfb263a6850c0048c63a3a98b7e45e50de35eba299a8e2994633e88ad00741646acf335513
SSDEEP 3072:S2vErT4a3De0+tDkGJsxxzL06/nIRWv7UuJKbekUMKGqiRetwuHZbUm7yD35keFQ:IDe0+tDkZe2vwuIekURGqaet9SQ
TLSH
T10664171776620AD7C97AE03C4A8B6515F7B0B8A04770A7CF22B1027D4F677F99E7A201
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6f:60:c9:0f:08:a6:99:d9:0e:31:08:35:05:c4:02:27

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Lbh-ssy-CA v1.01

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

6

Entry point

135292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

IsDebuggerPresent RaiseException Sleep GetCurrentProcess ExitProcess GetTickCount64 VirtualAlloc VirtualProtect GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryW lstrcatW lstrlenW WideCharToMultiByte GetModuleHandleExW FreeLibrary EncodePointer InterlockedFlushSList VirtualQuery RtlUnwindEx InitializeSListHead GetCurrentProcessId TerminateProcess IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetSystemTimeAsFileTime QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx GetCurrentThreadId InitializeCriticalSectionEx

user32

MessageBoxA

ole32

CoGetObjectContext CoInitializeEx

msvcrt

_msize __getmainargs __CppXcptFilter ?terminate@@YAXXZ _errno strcpy_s _initterm_e _initterm _callnewh abort _beginthreadex rewind ftell fseek fread fopen fclose rand malloc free _setjmp _local_unwind __DestructExceptionObject _amsg_exit __C_specific_handler memset memmove _CxxThrowException longjmp memcpy realloc __CxxFrameHandler3

Sharing

General

Malware Config

Signatures

File Explorer

def886efe8067633728cc43aadd30208ca861906aa0a3f6b529bbd5302c57561

PE Signature issue

kernel32

user32

ole32

msvcrt

generic