f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046

Sharing

Copy URL Twitter E-mail

General

Target
f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046
Size 221KB
Sample261029-w4793assft
SHA256 f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046
MD5 8393af9f319a176ce679a5f2aea2dcd4
SHA1 8865a5b62ffe32c2e8f3537ed3acd8582fcdf6ce
SHA512 c48b40b5fbf906068e28ddb5e2c78c8ea94951eb222bbe48a54c657e39cd6b88f07bef58aec0282bd10e38450221b457f7f7f02102279b540b7d7dc44cc0cd96
SSDEEP 6144:uyykT/DuWw+TijgS7scJVkwXIi6vFGZRp/gP0:vhcsGVkw4igFq/A
TLSH
T1AD247D15A6D50DFAE227C679C9524A05EA737C474730EACF03905AA78F236D09F3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046

File Explorer

f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046

.exe 221KB

f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046

IMPHASH 73d10088a8f04b53d4c9e3b63fd992dd
SHA256 f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046
MD5 8393af9f319a176ce679a5f2aea2dcd4
SHA1 8865a5b62ffe32c2e8f3537ed3acd8582fcdf6ce
SHA512 c48b40b5fbf906068e28ddb5e2c78c8ea94951eb222bbe48a54c657e39cd6b88f07bef58aec0282bd10e38450221b457f7f7f02102279b540b7d7dc44cc0cd96
SSDEEP 6144:uyykT/DuWw+TijgS7scJVkwXIi6vFGZRp/gP0:vhcsGVkw4igFq/A
TLSH
T1AD247D15A6D50DFAE227C679C9524A05EA737C474730EACF03905AA78F236D09F3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ShowWindow

advapi32

RegEnumValueW SetSecurityInfo OpenProcessToken GetSecurityDescriptorDacl GetTokenInformation RegCloseKey RegDeleteValueW RegSetValueExW RegOpenKeyExW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ShellExecuteExW

wintrust

WinVerifyTrust

kernel32

InitializeCriticalSectionEx WriteConsoleW SetEndOfFile HeapReAlloc HeapSize SetFilePointerEx GetCommandLineW GetEnvironmentVariableW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW CloseHandle GetLastError ReleaseMutex CreateMutexW GetCurrentProcess GetCurrentProcessId TerminateProcess OpenProcess GetTickCount64 GetModuleFileNameW LocalFree FormatMessageW QueryFullProcessImageNameW MoveFileExW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetFileSizeEx RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlLookupFunctionEntry EncodePointer ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress GetStdHandle WriteFile GetCommandLineA IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW SetStdHandle GetFileType HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW ReadFile GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW FlushFileBuffers GetConsoleOutputCP CreateFileW

Name

.text

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f9be9f7e3182c69e5d37cc70b53486532fc0e985814827e3a784988ac3a45046

user32

advapi32

shell32

wintrust

kernel32

generic