89e8e0bb-074f-4117-ae35-45e388a169c9

Sharing

Copy URL Twitter E-mail

General

Target
89e8e0bb-074f-4117-ae35-45e388a169c9
Size 409KB
Sample261029-g2b2hsad87
SHA256 b5511157eee11e818fca8eff59997bd86b8f153535b076e11aba5fa2868c2afe
MD5 40e4abaa2e5d66df74886cba7620e8ce
SHA1 c4700a578d65dfd4fea71f1fbfda91faa8a6b130
SHA512 e53cba2203e16a27a9b33dffe37c178d441f823a0abd5a8fbe4405323cbb2a0123d4446e5bbecb67ca294037a75e9b785fb0a28a32b8c9d48e40fb0905bca7d9
SSDEEP 6144:uV8GGtvlL2Gz/UsfR+dvzyeqZF0XjRJzfxJF+1INRm66ENd8:ujG10GbFgJND3kwNi
TLSH
T1FB941276EFE513C6F919A63BF410120A26D2F6148B2936D71C5240164C9DFCEAF392EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89e8e0bb-074f-4117-ae35-45e388a169c9

File Explorer

89e8e0bb-074f-4117-ae35-45e388a169c9

.exe 409KB

89e8e0bb-074f-4117-ae35-45e388a169c9

IMPHASH b03f3b7f88edb1394ede345b7504c609
SHA256 b5511157eee11e818fca8eff59997bd86b8f153535b076e11aba5fa2868c2afe
MD5 40e4abaa2e5d66df74886cba7620e8ce
SHA1 c4700a578d65dfd4fea71f1fbfda91faa8a6b130
SHA512 e53cba2203e16a27a9b33dffe37c178d441f823a0abd5a8fbe4405323cbb2a0123d4446e5bbecb67ca294037a75e9b785fb0a28a32b8c9d48e40fb0905bca7d9
SSDEEP 6144:uV8GGtvlL2Gz/UsfR+dvzyeqZF0XjRJzfxJF+1INRm66ENd8:ujG10GbFgJND3kwNi
TLSH
T1FB941276EFE513C6F919A63BF410120A26D2F6148B2936D71C5240164C9DFCEAF392EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4690

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

AllowSetForegroundWindow AppendMenuW CallWindowProcA CharNextA CreateMenu DestroyWindow DrawFocusRect GetClientRect GetMessageA GetWindowInfo GetWindowLongW RegisterClassExA RegisterDeviceNotificationA SetActiveWindow SetParent SetProcessDPIAware SetRect SetWindowContextHelpId SetWindowLongPtrA SetWindowTextA TrackMouseEvent TranslateMessage UpdateWindow ValidateRect

ntdll

LdrResSearchResource NtAlpcAcceptConnectPort NtAlpcCancelMessage NtDelayExecution NtDuplicateObject NtQueryDirectoryFileEx NtQueryInformationProcess NtQuerySystemInformation NtSetInformationFile NtWriteFile RtlAcquirePrivilege RtlAddAccessAllowedAceEx RtlAddAce RtlCompressBuffer RtlCreateUnicodeStringFromAsciiz RtlGetCompressionWorkSpaceSize RtlLengthSid RtlQueryFeatureConfiguration RtlQueryRegistryValuesEx RtlSetAllBits RtlSetBits RtlTimeFieldsToTime RtlUnhandledExceptionFilter RtlValidSecurityDescriptor TpReleaseAlpcCompletion TpReleaseIoCompletion WinSqmSetDWORD ZwCreateKey ZwSetValueKey ZwWaitForSingleObject

kernel32

AddVectoredExceptionHandler CancelWaitableTimer CloseHandle CompareStringOrdinal CreateFileW DebugBreak ExitProcess FileTimeToDosDateTime FindFirstFileW FindResourceExW GetCommandLineW GetConsoleCP GetCurrentProcess GetCurrentProcessId GetEnvironmentStringsW GetFileInformationByHandle GetFileSize GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringA GetProcAddress GetProcessHeap GetProcessId GetTickCount GetVersion GlobalFree GlobalUnlock HeapAlloc HeapFree InterlockedFlushSList IsThreadAFiber K32GetPerformanceInfo LoadLibraryA LocalSize OpenMutexA OpenMutexW PowerCreateRequest QueryPerformanceCounter QueryPerformanceFrequency ReadFile RemoveVectoredExceptionHandler ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlPcToFileHeader SetEnvironmentVariableW SetFilePointerEx SetThreadDescription SetThreadpoolThreadMinimum SetThreadpoolTimerEx SetWaitableTimer Sleep TerminateProcess TlsAlloc TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx WriteConsoleA

rpcrt4

I_RpcExceptionFilter Ndr64AsyncClientCall RpcBindingFree RpcBindingFromStringBindingW RpcEpUnregister RpcMgmtWaitServerListen RpcServerRegisterAuthInfoW RpcServerSubscribeForNotification RpcStringFreeW

userenv

RegisterGPNotification

ole32

CoTaskMemAlloc CoWaitForMultipleHandles CreateStreamOnHGlobal OleRun ProgIDFromCLSID

gdi32

ExtTextOutW GetStockObject SetBrushOrgEx

advapi32

AllocateAndInitializeSid CryptGenKey CryptSetHashParam DeleteService EnumDependentServicesW LsaClose NotifyServiceStatusChangeW QueryServiceStatus RegEnumValueW RegFlushKey RegOpenCurrentUser SetFileSecurityW TraceEvent

iphlpapi

FreeMibTable GetAdaptersAddresses ParseNetworkString

shell32

SHBindToParent SHCreateItemFromIDList ShellExecuteExW

shlwapi

AssocQueryStringW PathAddBackslashW StrStrW

crypt32

CertFreeCertificateContext CertGetCertificateChain CryptFormatObject CryptMsgClose PFXImportCertStore

version

GetFileVersionInfoExW VerQueryValueA

bcrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptHash BCryptKeyDerivation

gdiplus

GdipCreateBitmapFromScan0 GdipCreatePen1 GdiplusStartup

wininet

InternetCloseHandle

imm32

ImmSetConversionStatus

setupapi

SetupDiOpenDeviceInfoW

dwmapi

DwmIsCompositionEnabled

Sharing

General

Malware Config

Signatures

File Explorer

89e8e0bb-074f-4117-ae35-45e388a169c9

user32

ntdll

kernel32

rpcrt4

userenv

ole32

gdi32

advapi32

iphlpapi

shell32

shlwapi

crypt32

version

bcrypt

gdiplus

wininet

imm32

setupapi

dwmapi

generic