0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb

General

Target
0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb
Size 154KB
Sample261017-fpfnhaas21
SHA256 0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb
MD5 2e78df54771f450ed498246352f0f719
SHA1 9c87d8ff3e85b12c27caec661e37f9b5be4ca0b9
SHA512 7379ae0661567e235f0343db12cc289441cd60a15e39a8b897245fc427f8c51bb55a0d0b1142d1d442cca85e5423197699d96145df7f8ca3b7f566fdd5203d57
SSDEEP 1536:ZxV5njYOpFw6V6jfAaynx8V13P3nPCBTeqJbIZ8sUedVu:ZVnUfZyxWAB6qJ8Z8sUedVu
TLSH
T100F32B336155D4B2E0261E7A45900B3CECB54B636DB60577EFE8EEF26EA8132CB5240D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb

File Explorer

0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb

.dll 154KB

0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb

IMPHASH 405c0c739d7d7148c3683e7418ff7342
SHA256 0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb
MD5 2e78df54771f450ed498246352f0f719
SHA1 9c87d8ff3e85b12c27caec661e37f9b5be4ca0b9
SHA512 7379ae0661567e235f0343db12cc289441cd60a15e39a8b897245fc427f8c51bb55a0d0b1142d1d442cca85e5423197699d96145df7f8ca3b7f566fdd5203d57
SSDEEP 1536:ZxV5njYOpFw6V6jfAaynx8V13P3nPCBTeqJbIZ8sUedVu:ZVnUfZyxWAB6qJ8Z8sUedVu
TLSH
T100F32B336155D4B2E0261E7A45900B3CECB54B636DB60577EFE8EEF26EA8132CB5240D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

54896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindFirstFileW FindClose CreateThread CloseHandle CreateWaitableTimerA SetWaitableTimer GetExitCodeThread TerminateThread VirtualQueryEx VirtualProtectEx ReadProcessMemory WriteProcessMemory LocalAlloc LocalFree lstrcpyn CreateToolhelp32Snapshot Module32First Module32Next VirtualAllocEx VirtualFreeEx GetCurrentProcess GetProcessHeap MultiByteToWideChar ExitProcess HeapAlloc HeapReAlloc HeapFree IsBadReadPtr GetModuleFileNameA WritePrivateProfileStringA GlobalUnlock GlobalLock GlobalAlloc WaitForSingleObject CreateProcessA GetStartupInfoA GetPrivateProfileStringA GetCommandLineA FreeLibrary GetProcAddress LoadLibraryA LCMapStringA DeleteCriticalSection OpenProcess GetModuleHandleA GetCurrentProcessId CloseHandle CloseHandle CloseHandle CloseHandle CloseHandle LoadLibraryA GetProcAddress VirtualProtect

msvcrt

modf memmove realloc strchr strrchr strncmp strtod ??2@YAPAXI@Z ??3@YAXPAX@Z sprintf strncpy free malloc floor atoi _ftol modf

user32

CallWindowProcA MsgWaitForMultipleObjects OpenClipboard EmptyClipboard SetClipboardData CloseClipboard PeekMessageA GetMessageA TranslateMessage DispatchMessageA wsprintfA MessageBoxA SetTimer GetWindowThreadProcessId IsWindow GetInputState SetTimer

Sharing

General

Malware Config

Signatures

File Explorer

0b863493eb1fc02a3a98c76ef95d9d5986e67a6c0feb11692d26cd4923c2fbdb

kernel32

msvcrt

user32

generic