4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30

General

Target
4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30
Size 264KB
Sample261027-w4l2tswtat
SHA256 4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30
MD5 a59e86cf47e677d7f2f6b81aab947dc0
SHA1 7b9b497ee17adb51b1224f299429519ca7d86b35
SHA512 22e4c8d391d11b592b2d919a58440e3346e4c0de53254243af78afb1ef79595662c2344f6bcc35d5e9ae808fcbb77cd9afaa5d19ee4c0bf14068a7e2b3ecf464
SSDEEP 6144:rJMh2LLG4sSmTyvmzrqvrrodTyvmzrqvrro:rJMhuLG4sEOzrqvwAOzrqvw
TLSH
T19144CF57B2A530FDE1B787798492054AE777B83247209BEF03A083662F176D09D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30

File Explorer

4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30

.exe 264KB

4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30

IMPHASH 32cb449674a574996839b1312112b46a
SHA256 4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30
MD5 a59e86cf47e677d7f2f6b81aab947dc0
SHA1 7b9b497ee17adb51b1224f299429519ca7d86b35
SHA512 22e4c8d391d11b592b2d919a58440e3346e4c0de53254243af78afb1ef79595662c2344f6bcc35d5e9ae808fcbb77cd9afaa5d19ee4c0bf14068a7e2b3ecf464
SSDEEP 6144:rJMh2LLG4sSmTyvmzrqvrrodTyvmzrqvrro:rJMhuLG4sEOzrqvwAOzrqvw
TLSH
T19144CF57B2A530FDE1B787798492054AE777B83247209BEF03A083662F176D09D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Avalonia_Hbrowser\Launcher\x64\Release\GH9527Start.pdb

kernel32

GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap LCMapStringW LoadLibraryExW VirtualProtect GetConsoleMode GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP WriteConsoleW WaitNamedPipeW OpenMutexW CreateProcessW CreateThread CloseHandle GetLastError CreateEventW GetCurrentThreadId CreateFileW CreateMutexW WaitForMultipleObjects GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer GetStdHandle GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

user32

GetMessageW DefWindowProcW PostMessageW DestroyWindow GetDC IsWindowVisible MessageBoxW FillRect CreateWindowExW ScreenToClient GetSystemMetrics RegisterClassExW ShowWindow IsWindow DispatchMessageW GetWindowThreadProcessId AttachThreadInput BringWindowToTop TranslateMessage LoadIconW FindWindowW LoadCursorW DrawTextW PostQuitMessage PtInRect UpdateWindow SetForegroundWindow InvalidateRect IsIconic ReleaseDC BeginPaint EndPaint TrackMouseEvent

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetStockObject DeleteDC TextOutW GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen MoveToEx DeleteObject CreateSolidBrush

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4241145b278479247602a25f5954e56ef35e84327f51b57b14b0ec84e5f0cc30

kernel32

user32

gdi32

generic