e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df

Sharing

Copy URL Twitter E-mail

General

Target
e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df
Size 1.6MB
Sample261027-w6f9csf12k
SHA256 e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df
MD5 d88afcf1e71433adc9d32693c7ce511f
SHA1 13a510599ca9e0f13949c4cb8d747979bf9995a5
SHA512 bea50faae0e6b35169355f13d19f76684f5a2932fd65ce6b725014aadf658819420cbe80925e5bfb4993d9e2bd5e72266324167a2bed8422e4567f6a583f89a1
SSDEEP 24576:kAtxnBEOzYdOzYKGP7L9dhrr/PfBewnH4uOTXQM8uN8vEz1VIrhjAc:kAb+bfn9vReMH4EMZH2
TLSH
T178753B66FA748275D0B3C0BAC5D25B9AEE723041073096CB0299877D7F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df

File Explorer

e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df

.exe 1.6MB

e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df

IMPHASH c613298f3d788c876a8779d7844c93fa
SHA256 e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df
MD5 d88afcf1e71433adc9d32693c7ce511f
SHA1 13a510599ca9e0f13949c4cb8d747979bf9995a5
SHA512 bea50faae0e6b35169355f13d19f76684f5a2932fd65ce6b725014aadf658819420cbe80925e5bfb4993d9e2bd5e72266324167a2bed8422e4567f6a583f89a1
SSDEEP 24576:kAtxnBEOzYdOzYKGP7L9dhrr/PfBewnH4uOTXQM8uN8vEz1VIrhjAc:kAb+bfn9vReMH4EMZH2
TLSH
T178753B66FA748275D0B3C0BAC5D25B9AEE723041073096CB0299877D7F17BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\Avalonia_Hbrowser\GH9527-OnlineSetup\x64\Release\GH9527-OnlineSetup.pdb

kernel32

DeleteCriticalSection GetCurrentProcessId CreateProcessW GetModuleHandleW GetExitCodeProcess WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcessHeap LCMapStringW LoadLibraryExW VirtualProtect GetWindowsDirectoryW GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetUserDefaultUILanguage GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetProcAddress FindResourceW LoadResource CreateThread CloseHandle DeleteFileW LockResource Sleep GetPrivateProfileStringW GetSystemDirectoryW CreateFileW WaitForSingleObject FindClose GetTempPathW SetFilePointer InitializeCriticalSection LeaveCriticalSection WaitForMultipleObjects RemoveDirectoryW WriteFile FindNextFileW GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess GetCurrentProcess GetModuleFileNameW GetStdHandle InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetLastError RaiseException RtlPcToFileHeader EnterCriticalSection GetFileSizeEx FindFirstFileW SizeofResource GetCommandLineW CreateDirectoryW RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

user32

EndPaint BeginPaint ReleaseDC InvalidateRect EnableWindow GetWindowTextW PostQuitMessage DrawTextW GetClientRect EndDeferWindowPos GetWindowDC LoadCursorW FindWindowW UpdateWindow SetForegroundWindow LoadIconW GetMessageW DeferWindowPos DefWindowProcW AdjustWindowRectEx GetWindow GetWindowRect GetFocus DestroyWindow GetDC IsWindowVisible FillRect CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW RegisterClassExW ShowWindow IsWindow BeginDeferWindowPos OffsetRect DispatchMessageW RedrawWindow GetDlgCtrlID IsChild TrackMouseEvent FrameRect MoveWindow SetFocus TranslateMessage

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetStockObject DeleteDC SetTextColor SetBkMode LineTo CreatePen MoveToEx SetBkColor DeleteObject CreateSolidBrush RoundRect

advapi32

RegCreateKeyExW RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW ShellExecuteW

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize

winhttp

WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpConnect WinHttpSendRequest WinHttpReadData WinHttpCloseHandle

comctl32

InitCommonControlsEx ord413 ord410 ord17 ord411

shlwapi

PathAppendW PathFileExistsW

uxtheme

SetWindowTheme

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e83472ff16f8cbf36f3a3f13f4c4efb71423769be52f8275d9322f7c5b1dd5df

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

comctl32

shlwapi

uxtheme

generic