0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa

Sharing

Copy URL Twitter E-mail

General

Target
0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa
Size 358KB
Sample261014-m8hersz14m
SHA256 0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa
MD5 c1faac39515cc974e74fde3d029cc958
SHA1 a38cf9eb9f09df63eadc20a7335316bf8ff6dbd1
SHA512 287a42666bae10bb3171dfb7cc81794b349a1a3c8e0464a4010181aadeba7fe096076deac511d58c790c4dc64586249759b19fc46d29288be596427ad79e6fbf
SSDEEP 3072:nbahIHapWmv2qHCYzjWdJJ716MNpgnW+CfOjpgiJeNmLWDkVdqXLwfBUIt6nz1Jx:bwvA71F0p3JMmLWYX0kfs6CdEbV
TLSH
T15674281AEAA514F5D1BBD038C563251AF9713CAA43706BCB67A14A871F33FE4A53E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa

File Explorer

0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa

.dll 358KB

0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa

IMPHASH f90509b5b6c330f37f44d71412f943a6
SHA256 0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa
MD5 c1faac39515cc974e74fde3d029cc958
SHA1 a38cf9eb9f09df63eadc20a7335316bf8ff6dbd1
SHA512 287a42666bae10bb3171dfb7cc81794b349a1a3c8e0464a4010181aadeba7fe096076deac511d58c790c4dc64586249759b19fc46d29288be596427ad79e6fbf
SSDEEP 3072:nbahIHapWmv2qHCYzjWdJJ716MNpgnW+CfOjpgiJeNmLWDkVdqXLwfBUIt6nz1Jx:bwvA71F0p3JMmLWYX0kfs6CdEbV
TLSH
T15674281AEAA514F5D1BBD038C563251AF9713CAA43706BCB67A14A871F33FE4A53E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

SHGetSpecialFolderPathW ShellExecuteW

advapi32

CryptDestroyHash CryptHashData GetUserNameW CryptAcquireContextW CryptCreateHash CryptGetHashParam CryptReleaseContext

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CLSIDFromProgID CoCreateGuid CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

shlwapi

PathFileExistsW

kernel32

WriteConsoleW GetCurrentThreadId GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize SetStdHandle SetFilePointerEx GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetCommandLineW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx SetFilePointer WriteFile CloseHandle Sleep GetTickCount64 WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree EncodePointer DecodePointer LCMapStringEx GetCPInfo GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetACP IsValidCodePage FindFirstFileExW HeapReAlloc RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation

Name

.text

Size

248KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0fe99336b928c69e832d8a70d1d1e8af3f87b0b52e36fc75029acf8d104786aa

shell32

advapi32

ole32

oleaut32

shlwapi

kernel32

generic