269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f

General

Target
269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f
Size 220KB
Sample261027-c5n32axy4n
SHA256 269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f
MD5 5fd28f87ff16eaa0ca72c41f66dea1d9
SHA1 46eea1b01ff33435aeb65019a5a3b7a135916800
SHA512 8e7aa1590f7632e3404c902dcbcf90d2a3eb836b521fd3a8c17a2f999656a24a49406cb6f52b0e0b2ef71b22adef6e97e99b60a195825815c43405b00579816f
SSDEEP 3072:iXVZgMWUmOETGxEuPZC7g2encYmKn1KWoWmmcG6vUu:O4GaTQErfxnG6vU
TLSH
T1BA24C3817AE31112F57B1BB43DFDA472E63ABE725B328ACF4210925906E32D1587C772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f

File Explorer

269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f

.dll 220KB

269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f

IMPHASH df94e7c8995a1db2b713368622cf2c1f
SHA256 269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f
MD5 5fd28f87ff16eaa0ca72c41f66dea1d9
SHA1 46eea1b01ff33435aeb65019a5a3b7a135916800
SHA512 8e7aa1590f7632e3404c902dcbcf90d2a3eb836b521fd3a8c17a2f999656a24a49406cb6f52b0e0b2ef71b22adef6e97e99b60a195825815c43405b00579816f
SSDEEP 3072:iXVZgMWUmOETGxEuPZC7g2encYmKn1KWoWmmcG6vUu:O4GaTQErfxnG6vU
TLSH
T1BA24C3817AE31112F57B1BB43DFDA472E63ABE725B328ACF4210925906E32D1587C772
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

spoolss

EnumPortsW

user32

LoadStringW wsprintfW

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcpy memmove strchr strcmp strcpy strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

269817dbec5c73bae0a5b28c07cfd426345315fc6a132a5b5f902efe57469b9f

spoolss

user32

advapi32

ucrtbase

kernel32

ntdll

generic