e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f

Sharing

Copy URL Twitter E-mail

General

Target
e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f
Size 1.3MB
Sample261027-jcmstsbt4y
SHA256 e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f
MD5 b3a4696c71e1a0e0f4f1131ddc54d6eb
SHA1 c344c3469c2425a8696542ccc8c8ca964e9cd155
SHA512 e8cba634cea9840272dfb39358ff24861731930d893d35085d68f8f0b50acce00ada43b6710321a368f1cfd3bce9cb3e805dba744246307b311ab6f66367a784
SSDEEP 24576:VJYAXCB3Iu08R1CWabP8dPnThAmjTKtI5EkoBDwoBdfdxN:V+3Iu08R1m85ThHTKmyBh
TLSH
T16065F1923D81C9B6C6521C7985A5E3361ABF0F0B0E13C4479F715AC97EB3C887C626DA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f

File Explorer

e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f

.exe 1.3MB

e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f

IMPHASH e5ca2cec7567c1e7d3e2665a6266bab0
SHA256 e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f
MD5 b3a4696c71e1a0e0f4f1131ddc54d6eb
SHA1 c344c3469c2425a8696542ccc8c8ca964e9cd155
SHA512 e8cba634cea9840272dfb39358ff24861731930d893d35085d68f8f0b50acce00ada43b6710321a368f1cfd3bce9cb3e805dba744246307b311ab6f66367a784
SSDEEP 24576:VJYAXCB3Iu08R1CWabP8dPnThAmjTKtI5EkoBDwoBdfdxN:V+3Iu08R1m85ThHTKmyBh
TLSH
T16065F1923D81C9B6C6521C7985A5E3361ABF0F0B0E13C4479F715AC97EB3C887C626DA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119966

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\fhsource\qxzip\product\win32\dbginfo\base.pdb

kernel32

Sleep FindResourceW LoadLibraryW GetProcAddress FreeLibrary GetModuleFileNameW GetLastError DeleteFileW FindClose lstrlenW CreateFileW WideCharToMultiByte CloseHandle WriteFile lstrlenA MultiByteToWideChar ReadFile GetModuleHandleW GetSystemDirectoryW GetVersionExW GetCurrentProcess MoveFileW SleepEx SetLastError DuplicateHandle WaitForSingleObject ReleaseMutex SetEvent WaitForMultipleObjects CreateEventW CreateMutexW GetExitCodeThread TerminateThread GetTickCount ExpandEnvironmentStringsW FormatMessageW FindResourceExW GetPrivateProfileIntW LoadResource LockResource GetFileSize SizeofResource LocalAlloc SetEndOfFile SetEnvironmentVariableA CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileA SetStdHandle GetTimeZoneInformation RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread GetCurrentThreadId CreateThread RtlUnwind GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement ExitProcess GetCPInfo GetOEMCP IsValidCodePage LCMapStringA LCMapStringW HeapCreate VirtualFree VirtualAlloc GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetCurrentProcessId GetFullPathNameA GetCurrentDirectoryA GetConsoleCP GetConsoleMode SetFilePointer FlushFileBuffers LoadLibraryA GetStringTypeA GetStringTypeW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHCreateDirectoryExW SHChangeNotify ShellExecuteExW

ole32

CoInitialize

shlwapi

PathFileExistsW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

user32

UnregisterClassA

Sharing

General

Malware Config

Signatures

File Explorer

e9dd47ee493b48f744550c5a927a76faae0f3f98d5cb61d92d53a539d60ed58f

kernel32

advapi32

shell32

ole32

shlwapi

version

user32

generic