38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4

Sharing

Copy URL Twitter E-mail

General

Target
38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4
Size 1.9MB
Sample261014-hebb5sg15s
SHA256 38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4
MD5 937e9836814e24c91b2f491d37b903ca
SHA1 532433d4d7fdd2c6329cc8eb794d866f06b95ad5
SHA512 7a155fd2d0bb73201bb0834c8a6aa06f8b2319cbd79ff1b17cc1a1c15a09178be89168be27ae0325746698829bd772d227b3a3b6ef6fbc606f8281667da82880
SSDEEP 24576:YpNYx62pBHdEvvaoHGLr/j8oFGe73Y0XNSTEHUWbC57RptWX+EHPfLgD5unH/f8Y:GNYx62p9dEvvUa5unH8/uVLUT
TLSH
T1E9958E1752D802BEE1B7D13DCDA64A62EBF27C0D4770D6CF06E055661F23AE44A7A322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4

File Explorer

38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4

.exe 1.9MB

38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4

IMPHASH 3cc6ffd6fe28d11762d8da7b0416c2de
SHA256 38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4
MD5 937e9836814e24c91b2f491d37b903ca
SHA1 532433d4d7fdd2c6329cc8eb794d866f06b95ad5
SHA512 7a155fd2d0bb73201bb0834c8a6aa06f8b2319cbd79ff1b17cc1a1c15a09178be89168be27ae0325746698829bd772d227b3a3b6ef6fbc606f8281667da82880
SSDEEP 24576:YpNYx62pBHdEvvaoHGLr/j8oFGe73Y0XNSTEHUWbC57RptWX+EHPfLgD5unH/f8Y:GNYx62p9dEvvUa5unH8/uVLUT
TLSH
T1E9958E1752D802BEE1B7D13DCDA64A62EBF27C0D4770D6CF06E055661F23AE44A7A322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1078148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\sally\sally\build\out\sally\Release_x64\utils\salupdate.pdb

shell32

ShellExecuteW ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptHashData BCryptCreateHash

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetOpenW HttpQueryInfoW InternetCloseHandle InternetQueryOptionW InternetOpenUrlW InternetReadFile

kernel32

GetEnvironmentStringsW GetCommandLineA GetTimeZoneInformation SetConsoleCtrlHandler EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect SizeofResource GetOEMCP FindFirstFileExW SetLastError GetCommandLineW FindNextFileW WriteFile RemoveDirectoryW GetEnvironmentVariableW FindClose CreateFileW GetUserPreferredUILanguages GetACP SetFileAttributesW IsValidCodePage FormatMessageW GetLastError LockResource DeleteFileW CloseHandle FindResourceExW LoadResource GetLocalTime LocalFree GetCurrentProcessId GetModuleHandleW WideCharToMultiByte CreateDirectoryW GetFullPathNameW CompareStringOrdinal WaitForSingleObject GetFileAttributesW Sleep GetTickCount64 CreateProcessW CopyFileW CreateMutexW MultiByteToWideChar CreateThread MoveFileExW MulDiv FlushFileBuffers ReadFile FreeEnvironmentStringsW GetModuleFileNameW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW QueryFullProcessImageNameW GetFileSizeEx CopyFileExW LCMapStringEx DecodePointer IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW GetConsoleOutputCP HeapReAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetCurrentThread HeapAlloc HeapFree GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetStdHandle HeapSize WriteConsoleW GetLocaleInfoEx SetEndOfFile GetStringTypeW CompareStringEx FindFirstFileW RtlUnwind FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCPInfo

user32

GetWindowTextLengthW GetMessageW DefWindowProcW AdjustWindowRectEx MonitorFromPoint DestroyWindow GetDC IsWindowVisible SetWindowPos CreateWindowExW SendMessageW SetWindowTextW GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow IsDialogMessageW GetMonitorInfoW GetSysColor IsWindowEnabled SetFocus TranslateMessage LoadIconW FindWindowW LoadCursorW FlashWindowEx GetDlgItem DrawTextW PostQuitMessage GetSysColorBrush SystemParametersInfoW SetForegroundWindow DispatchMessageW IsIconic ReleaseDC GetCursorPos EnableWindow GetWindowTextW GetWindowThreadProcessId AllowSetForegroundWindow PostMessageW EnumWindows GetClassNameW MessageBoxW InvalidateRect

gdi32

GetDeviceCaps GetTextMetricsW GetTextExtentPoint32W SetTextColor SetBkColor CreateFontIndirectW SelectObject

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

38b63c9e76d85bbadb2392901ce0ba9126356be2756f6f8a2313ca269e41f8a4

shell32

ole32

bcrypt

version

wininet

kernel32

user32

gdi32

advapi32

generic