ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b

General

Target
ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b
Size 287KB
Sample261027-nktcsstvcs
SHA256 ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b
MD5 4165d72683274489175ff8f2a8b3fa92
SHA1 b6e054c42760ed137000f87fbb8060dcd2f5e894
SHA512 d18817de4cd77716667653f17f6cdd477d10177d7f9f294e360fa8f71d015f642322aa88fa7d070149fafa6355af848d2fc28c7d1cd814fe0038fd6c518b43f3
SSDEEP 3072:JzDGpeMT0r3/854JfJtr2hq8RsNZ4LueTW0rfSYXhiUPE2eEUZjVdbbs9uN0ac+3:JzyGCOtiRsNZ9eaeSYRiGPgFX4FjCaQ
TLSH
T15A548E19B7A914BAE167C17CC9538905EBF27C524761E6CF03A04BAB2F237E0963E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b

File Explorer

ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b

.dll 287KB

ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b

IMPHASH 52d17984a574605a320c6af562ab0cea
SHA256 ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b
MD5 4165d72683274489175ff8f2a8b3fa92
SHA1 b6e054c42760ed137000f87fbb8060dcd2f5e894
SHA512 d18817de4cd77716667653f17f6cdd477d10177d7f9f294e360fa8f71d015f642322aa88fa7d070149fafa6355af848d2fc28c7d1cd814fe0038fd6c518b43f3
SSDEEP 3072:JzDGpeMT0r3/854JfJtr2hq8RsNZ4LueTW0rfSYXhiUPE2eEUZjVdbbs9uN0ac+3:JzyGCOtiRsNZ9eaeSYRiGPgFX4FjCaQ
TLSH
T15A548E19B7A914BAE167C17CC9538905EBF27C524761E6CF03A04BAB2F237E0963E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA GetCurrentProcess TerminateProcess MultiByteToWideChar GetLastError lstrcpyA CloseHandle WideCharToMultiByte SetEndOfFile WriteConsoleW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW AreFileApisANSI GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetModuleFileNameW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetStdHandle GetFileType HeapAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

shell32

CommandLineToArgvW

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee53842e7f042e312d57244dcef8e5df6f084a49f9bedc9516a933552059776b

kernel32

shell32

generic