adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5

Sharing

Copy URL Twitter E-mail

General

Target
adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5
Size 1.3MB
Sample261024-mhhmvaa18p
SHA256 adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5
MD5 e9f23aa320ba592a7a68df9b9e43dc83
SHA1 6d6bf5975d855cba6195b9f241b84b0f8c1d232c
SHA512 01770316335fd201b33bb7966ea6a5aafe86628dae3d7678efbab772aeb7c9e90fb33606196bf9afeb21de22f711b6ea2ef1985926fb4ed83ee1e5866a0dcd76
SSDEEP 24576:Nq/Gaa5+56lWd3E3QgP4WYj4s7aMPKnCSt:Nq/A3QgGj4sjPKnCSt
TLSH
T1D4557C02FB92C9A7D8A6227881DE6318613DFC6007674ACB93401A75FD637D59E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5

File Explorer

adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5

.exe 1.3MB

adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5

IMPHASH 0d379df5a638377aecbcb544843b6b31
SHA256 adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5
MD5 e9f23aa320ba592a7a68df9b9e43dc83
SHA1 6d6bf5975d855cba6195b9f241b84b0f8c1d232c
SHA512 01770316335fd201b33bb7966ea6a5aafe86628dae3d7678efbab772aeb7c9e90fb33606196bf9afeb21de22f711b6ea2ef1985926fb4ed83ee1e5866a0dcd76
SSDEEP 24576:Nq/Gaa5+56lWd3E3QgP4WYj4s7aMPKnCSt:Nq/A3QgGj4sjPKnCSt
TLSH
T1D4557C02FB92C9A7D8A6227881DE6318613DFC6007674ACB93401A75FD637D59E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

AdjustWindowRect CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetSysColor GetSysColorBrush GetSystemMetrics IsDialogMessageW LoadCursorW LoadIconW LoadImageW MessageBoxW PostMessageW PostQuitMessage RegisterClassExW SetWindowTextW ShowWindow TranslateMessage UpdateWindow

gdi32

SetBkColor

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CreateFileW CreateIoCompletionPort CreateJobObjectW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW FlsAlloc FlsGetValue FlsSetValue GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetQueuedCompletionStatus GetStartupInfoW GetSystemTimeAsFileTime GetThreadContext GetThreadId InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadResource LockResource MultiByteToWideChar QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSRWLockExclusive ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileAttributesW SetInformationJobObject SetThreadContext SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualAllocEx VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv __p__wcmdln _assert _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswprintf_s fflush fputc fputs fwrite

api-ms-win-crt-string-l1-1-0

iswctype isxdigit memset strcmp strlen strncmp wcslen

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

Name

.text

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

736KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/30

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/42

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/53

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

adc5ec6ea52cba4ebaab3660c4e42f41a0f9e855b27f6988fc9075f7eac4d2d5

user32

gdi32

shell32

comctl32

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic