ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0

General

Target
ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0
Size 107KB
Sample261017-p3672sfa42
SHA256 ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0
MD5 2e75f92030936d440bc992fd05ff49c2
SHA1 4388c2ead17e38c9dd1d072bdbf32fa0cc50e8ba
SHA512 9d687c4ff80699cd8538bb5c6df312f354714d3bbe6acd4d7966de23e99ae9c7f73b6864cd1d812451bde281b665eb73850e0cc036927dd3c0199246fbb4eb6b
SSDEEP 3072:K4yG8uVL8V8xdGk4yTK3NK1o8rVYPbwIQAio3iP91Fxhs0T:KcViaPTK9K1rHvxN
TLSH
T14CB35C5777A900BBE2378AB8C4930A05D772B82207619FFF43A4461A1F233D59D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0

File Explorer

ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0

.dll 107KB

ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0

IMPHASH e44a8b52d6c96b6d42123e58873167aa
SHA256 ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0
MD5 2e75f92030936d440bc992fd05ff49c2
SHA1 4388c2ead17e38c9dd1d072bdbf32fa0cc50e8ba
SHA512 9d687c4ff80699cd8538bb5c6df312f354714d3bbe6acd4d7966de23e99ae9c7f73b6864cd1d812451bde281b665eb73850e0cc036927dd3c0199246fbb4eb6b
SSDEEP 3072:K4yG8uVL8V8xdGk4yTK3NK1o8rVYPbwIQAio3iP91Fxhs0T:KcViaPTK9K1rHvxN
TLSH
T14CB35C5777A900BBE2378AB8C4930A05D772B82207619FFF43A4461A1F233D59D3AB71
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls GetModuleFileNameA LoadLibraryA WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ac48e5c9c35e3f2c005b70036906a01d00bed0bb393d91cb1c5ea476d4fad4e0

kernel32

generic