2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb

General

Target
2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb
Size 296KB
Sample261029-w4anssd13s
SHA256 2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb
MD5 03e6acb94b29fc25936a97763856c7ec
SHA1 5cec6a73a6fadc9c1fd524f9a311956c674e3d05
SHA512 ce33b6eab5285e13259d8a57b5d9a65e852b8b6c31b6683856845f563d9c0ece36917997643e7ef0909f52d601eca1c20ee2383cca38d9a01ace2760f061a3b2
SSDEEP 6144:2CKdpHz89BgZgiNPUifph0lhSMXlBXBWfA4oLe:2CKdd89BriCyph0lhSMXl+fo
TLSH
T11E54BF16F672A0B6D2158A7889A70F48EF717C4583A0A7AF376C09D53FB3B90493DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb

File Explorer

2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb

.dll 296KB

2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb

IMPHASH 472b1f6efda705ffdecf57e4dcc77f27
SHA256 2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb
MD5 03e6acb94b29fc25936a97763856c7ec
SHA1 5cec6a73a6fadc9c1fd524f9a311956c674e3d05
SHA512 ce33b6eab5285e13259d8a57b5d9a65e852b8b6c31b6683856845f563d9c0ece36917997643e7ef0909f52d601eca1c20ee2383cca38d9a01ace2760f061a3b2
SSDEEP 6144:2CKdpHz89BgZgiNPUifph0lhSMXlBXBWfA4oLe:2CKdd89BriCyph0lhSMXl+fo
TLSH
T11E54BF16F672A0B6D2158A7889A70F48EF717C4583A0A7AF376C09D53FB3B90493DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers CloseHandle CreateThread DisableThreadLibraryCalls GetModuleHandleA MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter FreeLibrary GetProcAddress EnterCriticalSection GetCommandLineW InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA GetProcessHeap SetStdHandle CreateFileW HeapSize VirtualProtect LeaveCriticalSection RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess HeapAlloc HeapFree WriteFile FlsAlloc FlsGetValue FlsSetValue FlsFree

Name

.text

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2ecf6ce0bd7cbb00c290967a0277b8aa83244fc052a3f23f10d5102190969fbb

kernel32

generic