5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2

Sharing

Copy URL Twitter E-mail

General

Target
5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2
Size 1.3MB
Sample261027-e5tdvsav8t
SHA256 5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2
MD5 a871d0ab57c4b07f68ebe22f6c1224cb
SHA1 1fb24af4a3c6082639088eb45fdafcc78086967d
SHA512 d31f4fb021ec7476ace488d677fb5855c9e1b6f4cd313939226ac5e8aad7a743823acd63b896b8fd666b24e629543f965c56793344ce35c52a609c735a83ac0f
SSDEEP 12288:KH4v0zTUF8qX7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:KYQTUSqLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14555012B769842EDD9468638C291ED32E7377C165F3097CB07917E6B3E725E04D3A222
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2

File Explorer

5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2

.exe 1.3MB

5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2

IMPHASH 47fb36db31acf03377ba4b8c2364d7b1
SHA256 5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2
MD5 a871d0ab57c4b07f68ebe22f6c1224cb
SHA1 1fb24af4a3c6082639088eb45fdafcc78086967d
SHA512 d31f4fb021ec7476ace488d677fb5855c9e1b6f4cd313939226ac5e8aad7a743823acd63b896b8fd666b24e629543f965c56793344ce35c52a609c735a83ac0f
SSDEEP 12288:KH4v0zTUF8qX7Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:KYQTUSqLsqjnhMgeiCl7G0nehbGZpbD
TLSH
T14555012B769842EDD9468638C291ED32E7377C165F3097CB07917E6B3E725E04D3A222
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\zhanlue\pdfconverter\bin\x64\ReleaseGreen\pdb\2345PdfProcess.pdb

kernel32

GetModuleFileNameW CloseHandle CreateEventW WaitForSingleObjectEx ResetEvent SetEvent WaitForSingleObject LoadLibraryExW GetProcAddress FormatMessageW GetFileSizeEx DeleteFileW lstrlenW GetFullPathNameW CreateDirectoryW GetFileSize SetEndOfFile WriteFile GetModuleHandleW GetFileAttributesW GetLastError InitializeCriticalSectionAndSpinCount CreateFileW GetVersionExW GetCurrentThreadId ReadFile SetFilePointer LoadLibraryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetFileAttributesExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetEnvironmentVariableW HeapFree HeapAlloc LocalFree GetProcessHeap CreateMutexW ReleaseMutex

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z

vcruntime140

_CxxThrowException __C_specific_handler wcschr memmove __std_exception_copy __std_exception_destroy __std_terminate _purecall wcsstr __CxxFrameHandler3 memcpy memset

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _c_exit _cexit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _configure_wide_argv terminate _crt_atexit _initialize_wide_environment _get_wide_winmain_command_line _register_onexit_function _initterm _initterm_e exit _exit _initialize_onexit_table

api-ms-win-crt-string-l1-1-0

_wcsicmp towlower wcsncpy towupper

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

shell32

SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoTaskMemFree

Name

.text

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

5a639530a2a702395edcc93b47888692c98621f496b03d46464471b1f5902df2

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

ole32

generic