ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6

General

Target
ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6
Size 7.9MB
Sample261017-a17cpscd67
SHA256 ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6
MD5 cc575c12af80f25a83ec878f1e9882be
SHA1 9200b97261eac096eb91bb2129b36a278502209b
SHA512 6d861109b9b096b46e3f0827d2f539a746d55e1f8715e6b66b499150795f3cd8bf9b640618c2dca03045254cd2d67412f24e446f99368f294b189b3258718de8
SSDEEP 196608:qV4UgUe3OVUqexie0noVF7bQJiHYAQCx2C:qaUTe3OVUhp7tgQ7Q22
TLSH
T1A88601216E7D8121F422863C049CA577E5BBBBDDBB1F458B62B4263B1B23780492D773
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6

File Explorer

ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6

.exe 7.9MB

ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6

IMPHASH 9748dff59adc2eb458e84af4f4e581c8
SHA256 ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6
MD5 cc575c12af80f25a83ec878f1e9882be
SHA1 9200b97261eac096eb91bb2129b36a278502209b
SHA512 6d861109b9b096b46e3f0827d2f539a746d55e1f8715e6b66b499150795f3cd8bf9b640618c2dca03045254cd2d67412f24e446f99368f294b189b3258718de8
SSDEEP 196608:qV4UgUe3OVUqexie0noVF7bQJiHYAQCx2C:qaUTe3OVUhp7tgQ7Q22
TLSH
T1A88601216E7D8121F422863C049CA577E5BBBBDDBB1F458B62B4263B1B23780492D773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\a\b\d_00000000_\b\b\execroot\k\bazel-out\x86_32-windows-opt-ST-bd47c771e5d9\bin\product\kavkis\PPP\Install\Setup\starter\setup.pdb

gdi32

DeleteObject CreateFontA SelectObject SetTextColor CreateSolidBrush AddFontMemResourceEx RemoveFontMemResourceEx DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SetBkMode CreateDIBSection GetObjectW GetClipBox SetDIBitsToDevice GdiFlush CreateBitmap

kernel32

RaiseException CreateFileW ReadFile CloseHandle GetModuleHandleW HeapAlloc HeapFree GetProcessHeap LocalAlloc OpenProcess WaitForSingleObject DeleteFileW RemoveDirectoryW GetModuleFileNameW GetLastError CreateDirectoryW CompareStringW GetTempPathW ExpandEnvironmentStringsW CreateProcessW GetSystemWindowsDirectoryW GetExitCodeProcess GetCurrentProcessId FormatMessageW GetFileAttributesW SetCurrentDirectoryW LoadLibraryExW GetProcAddress FreeLibrary LocalFree MultiByteToWideChar GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleA GetCurrentProcess GetCurrentDirectoryW MoveFileW FindResourceW SizeofResource LoadResource LockResource SetLastError GetThreadId GetCurrentThreadId Sleep GetModuleHandleExW GetLocalTime SetUnhandledExceptionFilter SetEnvironmentVariableW GetWindowsDirectoryW GetLongPathNameW LoadLibraryW SetDllDirectoryW FindResourceExW GetTempFileNameW MoveFileExW WriteFile GetModuleFileNameA GetModuleHandleExA SetFilePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent ResetEvent DeleteCriticalSection MulDiv InitializeCriticalSectionEx DecodePointer QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW FormatMessageA FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle SetFilePointerEx AreFileApisANSI CopyFileW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW GetExitCodeThread QueryPerformanceFrequency EncodePointer LCMapStringEx GetCPInfo OutputDebugStringW VirtualQuery GetTickCount FlushInstructionCache RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode ReadConsoleW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapReAlloc HeapSize WriteConsoleW VirtualProtect VirtualAlloc GetSystemInfo LoadLibraryExA

Name

.text

Size

329KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.2MB

Virtual Size

6.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

ef3efbbc8d3d7f3d672340545dd501e4dedf030f96e94428e11e626ff1506ea6

gdi32

kernel32

generic