e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490

Sharing

Copy URL Twitter E-mail

General

Target
e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490
Size 179KB
Sample261017-qfmesstycy
SHA256 e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490
MD5 6ea0f789f97a801ec538d840e34d1233
SHA1 0d613a70680b26135d25154d25f5529d29eb4d9b
SHA512 27e4f26ffd563ed0f62004861d032640a539be81707d4beb1087e053519fd36b8624ba4d1ccbd6f7f1d3d9a76ea137153ef529f8844edddbb73d3cdab9d55a6d
SSDEEP 3072:Q67VH80xs9XcocqhKG4W+4/+9TL2Py0CtSsBF+KQYv9bJnie4WyZ1ERGt29Kdigl:Xh8QEOnF46ayFo
TLSH
T16704077667E5C417E176CB30AAF187E27736BD014F21CA1FEB40674D68B6220DA36722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490

File Explorer

e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490

.exe 179KB

e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490

IMPHASH 474528001ab873effcabb3877ca2fbe1
SHA256 e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490
MD5 6ea0f789f97a801ec538d840e34d1233
SHA1 0d613a70680b26135d25154d25f5529d29eb4d9b
SHA512 27e4f26ffd563ed0f62004861d032640a539be81707d4beb1087e053519fd36b8624ba4d1ccbd6f7f1d3d9a76ea137153ef529f8844edddbb73d3cdab9d55a6d
SSDEEP 3072:Q67VH80xs9XcocqhKG4W+4/+9TL2Py0CtSsBF+KQYv9bJnie4WyZ1ERGt29Kdigl:Xh8QEOnF46ayFo
TLSH
T16704077667E5C417E176CB30AAF187E27736BD014F21CA1FEB40674D68B6220DA36722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

gdi32

BitBlt CreateCompatibleDC DeleteDC DeleteObject GetStockObject SelectObject

kernel32

DelayLoadFailureHook ExitProcess FreeLibrary GetModuleHandleA GetProcAddress GetStartupInfoW GetTickCount HeapAlloc HeapReAlloc LoadLibraryA ResolveDelayLoadedAPI SetUnhandledExceptionFilter Sleep DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetSystemTimeAsFileTime InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__iob_func __set_app_type __wgetmainargs __winitenv _amsg_exit _cexit _fmode _fpreset _initterm _snprintf _strdup _vsnprintf _wcmdln exit free fwrite getenv malloc memcmp memcpy memmove rand sprintf srand strchr strcmp strcpy strcspn strlen time __dllonexit __lconv_init __setusermatherr _iob _lock _onexit _unlock calloc fprintf signal strncmp abort vfprintf

user32

AdjustWindowRect BeginPaint CheckMenuItem CreateWindowExW DefWindowProcW DialogBoxParamW DispatchMessageW EndDialog EndPaint GetDC GetDlgItemInt GetDlgItemTextW GetMenu GetMessageW GetMonitorInfoW GetSystemMetrics IntersectRect LoadAcceleratorsW LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxW MonitorFromRect MoveWindow PostQuitMessage RedrawWindow RegisterClassExW ReleaseCapture ReleaseDC SendMessageW SetCapture SetDlgItemInt SetDlgItemTextW SetTimer ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e402347840416154e9670b072dfcf75ae6d5d8c774a40b0b9230c111d3c33490

advapi32

gdi32

kernel32

msvcrt

user32

generic