cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e

Sharing

Copy URL Twitter E-mail

General

Target
cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e
Size 14.8MB
Sample261026-1bkeraca34
SHA256 cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e
MD5 83eee936de9fa1271ca8ee198c576e5b
SHA1 2618740464664ac8477f54b0245de7bbf0ba608a
SHA512 307c369ea4182f9ce0affb42dbc9b3b030af622a5e524fb38144372ae0185f138dcc8c0ca81e2c25791095b1a84117161bb14d16259ee359700b3a237bcf3d02
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2j:4iy0FOugpmcv/GDHL6JDk
TLSH
T13DF6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e

File Explorer

cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e

.exe 14.8MB

cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e

IMPHASH d3ea94810a363a25ffae345108dbec61
SHA256 cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e
MD5 83eee936de9fa1271ca8ee198c576e5b
SHA1 2618740464664ac8477f54b0245de7bbf0ba608a
SHA512 307c369ea4182f9ce0affb42dbc9b3b030af622a5e524fb38144372ae0185f138dcc8c0ca81e2c25791095b1a84117161bb14d16259ee359700b3a237bcf3d02
SSDEEP 196608:4XPU+ltkNzEc1Q2vU0LfutXvlQKkTtyotVKb1RTMkwLODu/yetyYcJJZhYvFza2j:4iy0FOugpmcv/GDHL6JDk
TLSH
T13DF6BF43B7E680B3EAD7D1B545BAAB7D4535BA3C032589CFB3842A494D322D1693930F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

268603

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance CoUninitialize CoInitialize IIDFromString StringFromGUID2 CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

shell32

SHGetFolderPathW SHGetFolderPathA CommandLineToArgvW

user32

LoadStringA MessageBoxA SendMessageTimeoutW CharNextA MessageBoxW GetMessageW GetMessageA DispatchMessageA DispatchMessageW MsgWaitForMultipleObjectsEx TranslateMessage PeekMessageA IsWindowUnicode wsprintfA

kernel32

GetFileInformationByHandle GetDriveTypeW DeleteFileW CreateDirectoryW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleCP GetFileType VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetModuleFileNameA SizeofResource GetCommandLineW LoadLibraryExA InitializeCriticalSectionAndSpinCount FindResourceA GetModuleHandleA MultiByteToWideChar GetLastError SetDllDirectoryA RaiseException IsDBCSLeadByte LoadResource DecodePointer GetProcAddress DeleteCriticalSection FreeLibrary WideCharToMultiByte lstrcmpiA SetCurrentDirectoryA DeleteFileA GetTickCount LocalFree GetEnvironmentVariableA GetModuleHandleExA GetCurrentThreadId Sleep FormatMessageW GetLocalTime GetCurrentProcessId FindFirstFileA WriteFile FileTimeToSystemTime FindClose WaitForSingleObject LocalAlloc CreateFileA GetSystemDirectoryA LockResource CloseHandle GetWindowsDirectoryA ExitProcess FormatMessageA ReadFile SetHandleInformation CreatePipe PeekNamedPipe RemoveDirectoryA CreateProcessA CreateDirectoryA GetExitCodeProcess SetLastError DeviceIoControl FindNextFileA CopyFileA GetFileAttributesA MoveFileExA SetFileAttributesA GetCurrentProcess GetModuleHandleExW GetTempPathA GetNativeSystemInfo GetSystemWow64DirectoryA SetEndOfFile SetFilePointerEx OpenMutexA LoadLibraryExW LoadLibraryW UnmapViewOfFile FlushViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile CreateFileW TlsAlloc LeaveCriticalSection InitializeCriticalSection TlsGetValue GetFullPathNameW SetStdHandle IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc HeapFree HeapAlloc ReadConsoleW GetFileSizeEx FlushFileBuffers GetCurrentDirectoryW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SwitchToThread GetStringTypeW TlsSetValue TlsFree GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime OutputDebugStringW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer GetModuleHandleW TerminateProcess EnterCriticalSection IsDebuggerPresent

advapi32

GetSecurityDescriptorDacl RegDeleteValueA RegOpenKeyExA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CopySid OpenProcessToken GetTokenInformation RegQueryValueExA RegEnumValueA RegEnumKeyExA GetSecurityDescriptorOwner SetFileSecurityA CryptAcquireContextA CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey RegQueryInfoKeyW RegDeleteKeyA RegCreateKeyExA RegSetValueExA

oleaut32

SysFreeString VarUI4FromStr GetErrorInfo

shlwapi

SHDeleteKeyA PathIsURLA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW

msi

ord117 ord115 ord159 ord141 ord44 ord204 ord91 ord67 ord8 ord158 ord137 ord160 ord168 ord31 ord189

Sharing

General

Malware Config

Signatures

File Explorer

cf5f4a0e35f4312455a05cad6fbf1e5ff612111a463b6001e2e8dbc0c3336f1e

ole32

shell32

user32

kernel32

advapi32

oleaut32

shlwapi

version

msi

generic