ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70

Sharing

Copy URL Twitter E-mail

General

Target
ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70
Size 191KB
Sample261020-le6ptsys5p
SHA256 ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70
MD5 ebbb6378ed5d9e63bdcef1d2a393a778
SHA1 2365a4881504482a313c4f2aaef063aadefcfca1
SHA512 84a3531c4a93a4dc70751f363f6e55c82341946192fb176a1ebc0b88a8df3f18551ae546bbad8fa5a846b17ee296b9e711de0c8f9cb9f42dacc382cb0b20397f
SSDEEP 3072:6izl/z/vmXW+46J/iTGG8rImkqDk1WC/MDKBSoj3hFz5x/pgdI9Vn:6OzmXl4wVDAWCEDKbD5x/kI9V
TLSH
T1D6141262DDCFA3F4D80B5B74E9CD8C5EF0A118A21B5FC62727C10B12D7D2AA66238511
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70

File Explorer

ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70

.dll 191KB

ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70

IMPHASH e3be7b9925dee6f763a4e9ed03cf2ae7
SHA256 ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70
MD5 ebbb6378ed5d9e63bdcef1d2a393a778
SHA1 2365a4881504482a313c4f2aaef063aadefcfca1
SHA512 84a3531c4a93a4dc70751f363f6e55c82341946192fb176a1ebc0b88a8df3f18551ae546bbad8fa5a846b17ee296b9e711de0c8f9cb9f42dacc382cb0b20397f
SSDEEP 3072:6izl/z/vmXW+46J/iTGG8rImkqDk1WC/MDKBSoj3hFz5x/pgdI9Vn:6OzmXl4wVDAWCEDKbD5x/kI9V
TLSH
T1D6141262DDCFA3F4D80B5B74E9CD8C5EF0A118A21B5FC62727C10B12D7D2AA66238511
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6630882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

AADTBAcquireToken ADSIAbandonSearch ADSICreateDSObject ADSIGetNextRow ADSIModifyRdn ADSIPrint ADsCreateAttributeDefinition AjCOyQMlvPxxWwGKMXbwxQcCTknQb BLdrYtrxzcwV BkLRzmzumFHXktXRXpquxXNRc ConvertSidToU2Trustee CreateResourceAccountAuthBuffer DlsWZoMkhLZEEyCvEVfPNBCPU EIHeecYjWuykUivNEzFMDlR EWmRUoPulkZtodJxWOEZQEEDDnZ EkaYNaQPWAHMDeFnAMLwGu ElPaUmCqgUJMl FreeADsStr GenericLogImpl HkiyxzZdqRtNMrpWZEBEAeSjurphl InitObjectInfo IsGCNamespace JTDqgUvrfuKIwBfUc JTajuyHaMLCIrDKax JVfoDiMqZmVK LdapCrackUserDNtoNTLMUser2 LdapMemFree LdapReadAttribute LdapResult LdapSearchInitPage MRlrLduZjPqalhxGqVTahIBjLQX MXeXYwNIPzVnEAMPXOUSmWYIuk MapLDAPTypeToADSType OCEQbwRVAvz QAbKNSKRDyFTzZkuhujHoPHyKjP RGiUHdLPjkzn RnZdjZbfrdXnPHNiLoZBi SMKMVeHVHCwNlEdVgchECZbzMLHuP SchemaGetClassInfo SchemaGetSyntaxOfAttribute SchemaOpen StartSigningFidoClientData TEZCZdhMlEBltFgphzBlsCFU VLrbtmqgBW VokvUXYmhyJOBhIrAjvOODxe WSCheckForConsumable WSLicenseClose WSLicenseGetAllValidAppCategoryIds WSNotifyOOBECompletion WSTriggerOOBEFileValidation WSpTLRW XSlAJPOwGaN ZGSsCQgqNb ZoGdgBOnszKaJlHvMk aeCXVIfKzmbXjqBgyMAtHBKLiiiS bIBJLWBCFSrDPiPcsPNd bYYFElOFYiIiSRHeDokI bhZUSIJOXtvaWTq cbOIYOhnOThwcKwYxAkQW enWpuqBpaXAjAlfAOyLYtcGMmPYgg fapweNrnJsvwXNL glColor3fv glColor3s glColor3sv glColor4bv glColor4d glColor4uiv glCullFace glDepthMask glFinish glFogf glGetClipPlane glIndexPointer glIndexubv glLightModelfv glLightiv glLogicOp glMateriali glMaterialiv glNormal3iv glPixelMapuiv glPointSize glPopName glRasterPos4i glRasterPos4sv glTexCoord1dv glTexCoord1f glTexCoord1fv glTexGend glTexGenfv glVertex3s glVertex4sv iEnGgoYKtGyKgqmsY iWRqhGMDjfPPvcCjFluAxpmo ivUhfSlYtwKRIOfpDCYhhDJRN iwwaqznNRZVEetBc krHrNxFlDYFyikQCfiC njXZBBdLRSxsvHjSYcMySHZmHLZ oUXiPwldjcsvSufh oagaRcBvhgkDrZW pfBuJDMxlvEGcrKpu pqTMYxZgFzTKUEbMtsKbGQEn qLnpTdDVJMrpwwSeHYI rwwpApnNWIBgzlA tOOngqJxTDdA uItkflMBVlQVcFVSqhuZ ucQfQqomDU vGNoUjTtKdsVqGOC vSfhKGIEWrg wAAevDocYBGUOnbsgKfpQFh wglCreateLayerContext wglSetLayerPaletteEntries xGzweebWXfDMwC ypJPPbrIXwKACLrUBfulvZDQR

Name

.text

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

1012B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.KrrD

Size

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.DukE

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ef3a94b6dbd83bcf04e6d612ce5408a6c0f05a78f4efd9421284e1db247f0a70

kernel32

msvcrt

user32

generic