037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b

Sharing

Copy URL Twitter E-mail

General

Target
037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b
Size 313KB
Sample261027-w4l2tswtas
SHA256 037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b
MD5 23bb1a51a7a75277da65c57298d7e2d1
SHA1 501e1685fdcdde4f8e85d1b44423a82a687873c4
SHA512 668733c1ed05e0715c81adccfd35d5927bd1d0cc96453541e19c1fa3dd3d5280af2466f8e2018293503c83ff160d251e1d3e1badc53b66b67aa9da10ff98d976
SSDEEP 6144:EqlQ6mKWmatnRS9GU/z5yaKBtbdYHgPYmZPB:EqadKWmGRS9lz54BtJYmYA
TLSH
T1FF649D19B7A50CBAE56B863DCC034906EBF2BC5647A0E64F03E00A9B5F377A0563D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b

File Explorer

037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b

.dll 313KB

037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b

IMPHASH d9555708eb0d57f0cdda508ae67bf14a
SHA256 037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b
MD5 23bb1a51a7a75277da65c57298d7e2d1
SHA1 501e1685fdcdde4f8e85d1b44423a82a687873c4
SHA512 668733c1ed05e0715c81adccfd35d5927bd1d0cc96453541e19c1fa3dd3d5280af2466f8e2018293503c83ff160d251e1d3e1badc53b66b67aa9da10ff98d976
SSDEEP 6144:EqlQ6mKWmatnRS9GU/z5yaKBtbdYHgPYmZPB:EqadKWmGRS9lz54BtJYmYA
TLSH
T1FF649D19B7A50CBAE56B863DCC034906EBF2BC5647A0E64F03E00A9B5F377A0563D712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileAttributesW SetFileAttributesW Sleep GetTickCount64 GetLastError LockResource QueryPerformanceFrequency CloseHandle FreeConsole CreateThread LoadResource FindResourceW GetCurrentDirectoryW GlobalMemoryStatusEx CopyFileW GetConsoleWindow QueryPerformanceCounter WriteConsoleW HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CreateFileW IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetModuleFileNameW VirtualAlloc ExpandEnvironmentStringsW GetCurrentProcess VirtualFree VirtualProtect SizeofResource GetModuleFileNameA ReadFile CreateDirectoryW GetProcessHeap GetProcAddress HeapAlloc GetModuleHandleA GetConsoleOutputCP WriteFile FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind GetFileType GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc GetACP HeapFree WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount

user32

MessageBoxW ShowWindow

advapi32

LookupPrivilegeValueW RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken

ole32

CoGetObject CoInitializeEx CoUninitialize

shell32

ord680

Sharing

General

Malware Config

Signatures

File Explorer

037687ed391552947019dd4015694d7e074b77cfb991e0830262e511b2d4627b

kernel32

user32

advapi32

ole32

shell32

generic