b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5

Sharing

Copy URL Twitter E-mail

General

Target
b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5
Size 310KB
Sample261017-brt7fsce49
SHA256 b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5
MD5 831b91c2260313e33de8906187dcbf9a
SHA1 58b1020d28b992864fe4b26636cdf6e226fc5fe6
SHA512 eb3906cba482220c9484b0b3947a632ae76e0a497fb81b733070e939754cc9ebe9dadf865458401991eab9b75c18a600db266ad1b060faeb9b572410f6aa20d8
SSDEEP 3072:IHk1LDTjTDTjTb0KEdWFaNUTeBQiFmQjJjMum4QSpxy/v6mZv97HTv8cPjyLIQYq:IEuKwUBKvXWSpbmZv97TvXJpzw1V
TLSH
T17F646B41B6A400A5E8BB523889635A51F9723D550374A7EF0F90B379AF7B7C1A03FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5

File Explorer

b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5

.dll 310KB

b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5

IMPHASH f114055599df118283a8d39285a97f81
SHA256 b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5
MD5 831b91c2260313e33de8906187dcbf9a
SHA1 58b1020d28b992864fe4b26636cdf6e226fc5fe6
SHA512 eb3906cba482220c9484b0b3947a632ae76e0a497fb81b733070e939754cc9ebe9dadf865458401991eab9b75c18a600db266ad1b060faeb9b572410f6aa20d8
SSDEEP 3072:IHk1LDTjTDTjTb0KEdWFaNUTeBQiFmQjJjMum4QSpxy/v6mZv97HTv8cPjyLIQYq:IEuKwUBKvXWSpbmZv97TvXJpzw1V
TLSH
T17F646B41B6A400A5E8BB523889635A51F9723D550374A7EF0F90B379AF7B7C1A03FB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

LockResource FindResourceW lstrcmpA lstrcmpW lstrcmpiW MultiByteToWideChar WideCharToMultiByte lstrlenA HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetStringTypeW SetFilePointerEx HeapAlloc LoadResource LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW ReadFile GetFileSize SetLastError GetCurrentProcessId CloseHandle GetTempPathW GetProcessHeap HeapFree WriteFile GetFileSizeEx CreateFileW GetCommandLineW GetCommandLineA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

user32

MessageBoxW wsprintfA SendMessageW DialogBoxParamW EndDialog GetDlgItem LoadCursorW GetParent SetWindowLongPtrW GetWindowLongPtrW SetDlgItemTextW SetCursor GetSysColorBrush SetWindowTextW EnableWindow SendDlgItemMessageW GetDlgItemTextW

winspool.drv

ClosePrinter EnumPrintersW OpenPrinterW SetPrinterW GetPrinterW DocumentPropertiesW

advapi32

RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCloseKey

gdi32

SetBkMode SetTextColor

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

ShellExecuteW

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b4b5d8081afd7ee72188e3cf3c10d57ad4b607965e178f57f0339569d0f34ae5

kernel32

user32

winspool.drv

advapi32

gdi32

comdlg32

shell32

generic