6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c

Sharing

Copy URL Twitter E-mail

General

Target
6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c
Size 1.5MB
Sample261027-kdb86abw4x
SHA256 6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c
MD5 bbcd7a24b7838a13380c516820efdc5e
SHA1 f15b005214baab65f228cbee699464f04250530b
SHA512 33588abbe6b02686d26379997d663e4310e21739d140dcc2735a9f61b18680c8daf0339af35058772b3e9d467b8aab04decf44a5b4ff5cff3113a12d48a456a5
SSDEEP 24576:sPbVlSHA3nXWaPSYdSn1uURkYxYXO3BM5z3h46aIaWCMDsqjnhMgeiCl7G0nehbo:sqHenyDYXO3OZ3xaWrDmg27RnWGj
TLSH
T14B75BE1A669829E5D037D13EC7B39BD2E77678014B30D6CF02D5036E2E2B6E5793A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c

File Explorer

6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c

.exe 1.5MB

6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c

IMPHASH 4e969f9ed6bb360b0ee6ddea316ef25b
SHA256 6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c
MD5 bbcd7a24b7838a13380c516820efdc5e
SHA1 f15b005214baab65f228cbee699464f04250530b
SHA512 33588abbe6b02686d26379997d663e4310e21739d140dcc2735a9f61b18680c8daf0339af35058772b3e9d467b8aab04decf44a5b4ff5cff3113a12d48a456a5
SSDEEP 24576:sPbVlSHA3nXWaPSYdSn1uURkYxYXO3BM5z3h46aIaWCMDsqjnhMgeiCl7G0nehbo:sqHenyDYXO3OZ3xaWrDmg27RnWGj
TLSH
T14B75BE1A669829E5D037D13EC7B39BD2E77678014B30D6CF02D5036E2E2B6E5793A321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\workspace\git_2345ad\bin\x64\Release\2345Ad.pdb

kernel32

SearchPathW LoadLibraryW FindFirstFileW FindNextFileW FindClose GetLongPathNameW GetShortPathNameW CreateFileW GetFileAttributesExW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection ReadFile WriteFile SetFileTime SetFilePointer SetEndOfFile CloseHandle GetFileSize GetFileTime CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW GetTempPathW GetFileAttributesW GetSystemDirectoryW SetFileAttributesW DeleteFileW GetCurrentDirectoryW GetWindowsDirectoryW MoveFileExW CopyFileW GetTempFileNameW MoveFileW LocalFree GetCommandLineW LoadLibraryExW DeviceIoControl FileTimeToDosDateTime GetModuleHandleW GetExitCodeProcess InitializeCriticalSectionAndSpinCount WaitForSingleObject GetTickCount CreateProcessW ExpandEnvironmentStringsW GetPrivateProfileStringW WritePrivateProfileStringW GetVersionExW GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer TlsAlloc TlsGetValue FreeLibrary TlsFree GetStdHandle GetModuleFileNameW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP GetCurrentThread GetStringTypeW HeapFree HeapAlloc GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringA OutputDebugStringW WaitForSingleObjectEx CreateThread FindFirstFileExA FindFirstFileExW FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SetStdHandle GetProcessHeap SetConsoleCtrlHandler HeapSize HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx FlushFileBuffers WriteConsoleW LoadLibraryA GetEnvironmentVariableW GetComputerNameExW OpenProcess GlobalAlloc GlobalFree LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW CreateMutexW ReleaseMutex Sleep OpenMutexW lstrcatW lstrcpyW GetFileSizeEx QueryDosDeviceW WaitForMultipleObjects GetVolumeInformationW GetDiskFreeSpaceW GetLogicalDriveStringsW FormatMessageW DosDateTimeToFileTime GetSystemTime SystemTimeToFileTime FileTimeToLocalFileTime FileTimeToSystemTime LocalFileTimeToFileTime GetTimeZoneInformation RtlUnwind GetProcAddress SetCurrentDirectoryW GetDriveTypeW GetLastError TlsSetValue SetErrorMode ReadConsoleW

shell32

CommandLineToArgvW ShellExecuteExW SHFileOperationW ShellExecuteW ord68 SHChangeNotify SHGetDesktopFolder SHGetFolderLocation SHGetFolderPathW SHGetSpecialFolderPathW SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListW

shlwapi

SHAutoComplete

user32

InvalidateRect GetDC SetForegroundWindow GetForegroundWindow EnableWindow GetDlgCtrlID IsIconic GetWindow GetLastActivePopup GetWindowThreadProcessId GetClassNameW FindWindowExW GetWindowLongPtrW CopyRect GetMonitorInfoW GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW MonitorFromWindow MessageBoxW SetWindowPos IsWindow AttachThreadInput SendMessageW GetParent GetActiveWindow GetDlgItem ShowWindow MapWindowPoints SystemParametersInfoW GetProcessWindowStation GetUserObjectInformationW ReleaseDC

gdi32

GetDeviceCaps GetStockObject CreateFontIndirectW

advapi32

RegisterEventSourceW GetUserNameW DeregisterEventSource ReportEventW

ole32

CoTaskMemFree CoCreateInstance

Name

.text

Size

606KB

Virtual Size

605KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

184KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6f55ec6fc09015819237476fb1e33246cd0de4160016b234fd8b4ccdbe7d386c

kernel32

shell32

shlwapi

user32

gdi32

advapi32

ole32

generic