b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

General

Target
b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3
Size 1.5MB
Sample261027-e6lems1wcv
SHA256 b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3
MD5 05c417a00b05eab33b8b6dcb0f7b9394
SHA1 2bb2ead39c9ffa9ce3cc74e6f0d294a6909f4086
SHA512 84b4c59fb29584d67f1f994261e9bf249b8cf9d53218658cad929cde699b3424e2eb84d541ea40b254e46a49c653638d601dad1e5fd27d72193c780e63ad3ced
SSDEEP 24576:HmQIjyJafN0QNd0x4Zo6VEXzaXsKzMInMXvGRsqjnhMgeiCl7G0nehbGZpbD:GQEGa5H0x4ZoqWIzLnMelDmg27RnWGj
TLSH
T1F27522107592843BD5B3083205B8D6FA593FBC315A3459EBA3E52A7EDE302D18636E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

File Explorer

b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

.exe 1.5MB

b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

IMPHASH cf66a35ed7d4fd0b4081e73f6b0ade9d
SHA256 b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3
MD5 05c417a00b05eab33b8b6dcb0f7b9394
SHA1 2bb2ead39c9ffa9ce3cc74e6f0d294a6909f4086
SHA512 84b4c59fb29584d67f1f994261e9bf249b8cf9d53218658cad929cde699b3424e2eb84d541ea40b254e46a49c653638d601dad1e5fd27d72193c780e63ad3ced
SSDEEP 24576:HmQIjyJafN0QNd0x4Zo6VEXzaXsKzMInMXvGRsqjnhMgeiCl7G0nehbGZpbD:GQEGa5H0x4ZoqWIzLnMelDmg27RnWGj
TLSH
T1F27522107592843BD5B3083205B8D6FA593FBC315A3459EBA3E52A7EDE302D18636E73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

50652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\vmagent_new\bin\joblist\695102\out\Release\safehp.pdb

kernel32

CloseHandle RaiseException DecodePointer GetProcAddress DeleteCriticalSection GetCurrentProcessId GetModuleHandleW FreeLibrary LoadLibraryExW MultiByteToWideChar GetLastError CreateFileW WriteConsoleW InitializeCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW DeviceIoControl WriteFile GetStdHandle WideCharToMultiByte SetLastError CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW ReadFile GetFileSizeEx SetFilePointerEx LocalFileTimeToFileTime CreateFileA SystemTimeToFileTime HeapFree HeapLock CreateMutexW WaitForSingleObject GetCurrentThreadId ReleaseMutex HeapWalk HeapAlloc GetProcessHeap HeapUnlock OpenThread SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameA GetCommandLineA GetCommandLineW GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType HeapSize FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW EnterCriticalSection

advapi32

RegQueryValueExA RegQueryValueExW RegOpenKeyExW RegCloseKey RegEnumKeyExW

shlwapi

PathFileExistsW SHGetValueW PathCombineW

imm32

ImmDisableIME

Sharing

General

Malware Config

Signatures

File Explorer

b52f85835877ae20d83c8f4c9a4a85490e73c3d5139ccbd66839ab0fac51a3e3

kernel32

advapi32

shlwapi

imm32

generic