e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550

Sharing

Copy URL Twitter E-mail

General

Target
e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550
Size 99KB
Sample261018-rtb2nabd32
SHA256 e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550
MD5 f1b43789d2640d4c4187dbe7a995ddff
SHA1 278629b238bd0571874f6abf3beaf3d742471dd6
SHA512 e8745f44e307b96c1e70d788822bc783e80fe7fdb52aa350f25eeaaf69d848dc9d8d467a26515275dbf08edc5f122e59f86041a8ee78e322ef46a3b5901f15e5
SSDEEP 1536:3nXULHj9VWWMdlUN/wNupgPs8xhgT3Tum5OClZhD9Lut+:3nkf9VWBjULgcD95OihDUo
TLSH
T133A32912F39114B9D072C5308A7A9333A333FB961425AB1E1664A5182FB1FD0BE79FD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550

File Explorer

e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550

.exe 99KB

e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550

IMPHASH f273b0e5a41f8a8ed8dc6496f1a816bb
SHA256 e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550
MD5 f1b43789d2640d4c4187dbe7a995ddff
SHA1 278629b238bd0571874f6abf3beaf3d742471dd6
SHA512 e8745f44e307b96c1e70d788822bc783e80fe7fdb52aa350f25eeaaf69d848dc9d8d467a26515275dbf08edc5f122e59f86041a8ee78e322ef46a3b5901f15e5
SSDEEP 1536:3nXULHj9VWWMdlUN/wNupgPs8xhgT3Tum5OClZhD9Lut+:3nkf9VWBjULgcD95OihDUo
TLSH
T133A32912F39114B9D072C5308A7A9333A333FB961425AB1E1664A5182FB1FD0BE79FD6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGetHashParam CryptHashData CryptReleaseContext GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

DefSubclassProc SetWindowSubclass

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetStockObject GetTextExtentPoint32W GetTextMetricsW IntersectClipRect LineTo MoveToEx Rectangle RestoreDC RoundRect SaveDC SelectObject SetBkMode SetTextColor SetViewportOrgEx TextOutW

iphlpapi

GetAdaptersAddresses

kernel32

AttachConsole CloseHandle CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetLastError GetLocalTime GetModuleFileNameW GetProcAddress GetStartupInfoA GetStdHandle GetSystemDirectoryW GetTempPathW InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW ReadFile SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiW lstrcpynW lstrlenW

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _fmode _initterm _onexit _snprintf _snwprintf _vsnwprintf _wcsicmp _wtoi64 abort calloc exit fprintf free fwrite malloc memcpy realloc signal strchr strlen strncmp strrchr strstr vfprintf wcschr wcslen wcsncpy_s wcspbrk wcsrchr wcsstr

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW ShellExecuteW

user32

AppendMenuW BeginPaint CharLowerW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DispatchMessageW DrawFocusRect DrawFrameControl DrawTextW EnableWindow EndPaint EnumWindows FillRect GetCapture GetClientRect GetCursorPos GetDC GetDlgCtrlID GetMessageW GetParent GetSysColorBrush GetSystemMetrics GetWindow GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId InflateRect InvalidateRect IsIconic IsWindow IsWindowVisible IsZoomed KillTimer LoadCursorW LoadImageW MessageBoxW MonitorFromRect MoveWindow PostMessageW PostQuitMessage PtInRect RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetCursor SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e03f7bbf00e3026d79c781a8ea451412b123bed775a4014edadca05f4facd550

advapi32

comctl32

gdi32

iphlpapi

kernel32

msvcrt

ole32

oleaut32

shell32

user32

generic