edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e

General

Target
edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e
Size 2.4MB
Sample261030-jcmstsdh25
SHA256 edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e
MD5 5a699aebaea791f1a2b0a458d9d71ee5
SHA1 4d45ed6e0676f337dd53b74bec97e8b217731a67
SHA512 0f7d3f05c2fc9510b609769f004436ba13ccf54f23ecdc2160987e6d3da7862c1ea5d95f78464ad10209c2037ffd08da412e450ed7caf03ffe6267d168157a6f
SSDEEP 49152:x1UuIf9i9832AD3To2Wkh3hbuJoXGOl9UpcZfnZSQ+bCX7EU/sQ3DXN:vUn0K32ATTo2WkNhbuJoXGOTrZPcvsE4
TLSH
T180B51213AAA2F957CCB75A31CE41CB529E2CEDA0078145EF739A2D5D99303E246B3371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e

File Explorer

edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e

.exe 2.4MB

edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e

IMPHASH ea0fb729d42f105223cf2749fb8975c0
SHA256 edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e
MD5 5a699aebaea791f1a2b0a458d9d71ee5
SHA1 4d45ed6e0676f337dd53b74bec97e8b217731a67
SHA512 0f7d3f05c2fc9510b609769f004436ba13ccf54f23ecdc2160987e6d3da7862c1ea5d95f78464ad10209c2037ffd08da412e450ed7caf03ffe6267d168157a6f
SSDEEP 49152:x1UuIf9i9832AD3To2Wkh3hbuJoXGOl9UpcZfnZSQ+bCX7EU/sQ3DXN:vUn0K32ATTo2WkNhbuJoXGOTrZPcvsE4
TLSH
T180B51213AAA2F957CCB75A31CE41CB529E2CEDA0078145EF739A2D5D99303E246B3371
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57084

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\src\_LdsCode\sysloader\sysloader-inst-uninst\bin\Inst\Release\Install.pdb

kernel32

MultiByteToWideChar TerminateProcess SetLastError GetModuleHandleW ExitThread GetCurrentProcess InitializeCriticalSectionEx GetLastError DecodePointer CreateThread WideCharToMultiByte FindResourceW SizeofResource LockResource LoadResource GetProcAddress FreeLibrary FindResourceExW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId GetCurrentProcessId FindNextFileW FindClose HeapReAlloc InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread LocalFree EncodePointer QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException CreateFileW GetModuleFileNameW GetACP ExitProcess ReadFile SetEndOfFile WriteFile InitializeCriticalSectionAndSpinCount WriteConsoleW GetModuleHandleExW GetOEMCP GetCommandLineW CancelSynchronousIo FlushFileBuffers GetFileSizeEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead LoadLibraryExW GetStdHandle GetFileType GetModuleHandleA RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree SetStdHandle CompareStringW LCMapStringW SetFilePointerEx GetConsoleOutputCP GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapAlloc HeapDestroy CloseHandle

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxA RegisterWindowMessageW

advapi32

DeregisterEventSource RegisterEventSourceA ReportEventA

Sharing

General

Malware Config

Signatures

File Explorer

edca8856e559a6542fe2aa54fc9c978a68750c4731bf883332339407baae461e

kernel32

user32

advapi32

generic