dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c

General

Target
dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c
Size 2.2MB
Sample261030-kenctaxvdx
SHA256 dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c
MD5 7929a903c220db81bae10e1bc39cc763
SHA1 f638ee9937a8912dafeec8221efebd3961fcd531
SHA512 f03a684803d02ac5d520c64cd1684e0d4ec56ab6f97fedc3449d76d05c252c2d66309a261dd57644d0d06e16598c36ffaf5e8a9f954d29f0c4fc34e39573aa42
SSDEEP 49152:OBFfAHnrxZfj65iLlBUKubZrX+ldF+sfXTuVvpnn5KrY7B:OBFfAHnzQiBSTZL+ldQUuBpn5z
TLSH
T1CFB5E0507666D233E47181F24E78AFB6A06DAD2D0F710ACF63D42B3945362D26E31F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c

File Explorer

dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c

.exe 2.2MB

dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c

IMPHASH 3a90dbf59541f81dd61ecb0cc35041cd
SHA256 dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c
MD5 7929a903c220db81bae10e1bc39cc763
SHA1 f638ee9937a8912dafeec8221efebd3961fcd531
SHA512 f03a684803d02ac5d520c64cd1684e0d4ec56ab6f97fedc3449d76d05c252c2d66309a261dd57644d0d06e16598c36ffaf5e8a9f954d29f0c4fc34e39573aa42
SSDEEP 49152:OBFfAHnrxZfj65iLlBUKubZrX+ldF+sfXTuVvpnn5KrY7B:OBFfAHnzQiBSTZL+ldQUuBpn5z
TLSH
T1CFB5E0507666D233E47181F24E78AFB6A06DAD2D0F710ACF63D42B3945362D26E31F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

487641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\pub_st0e\master_kso_v12\Build\Release\WPSOffice\office6\wpscloudsvr.pdb

kernel32

SetCurrentDirectoryW FreeLibrary GetModuleFileNameW GetProcAddress LoadLibraryW GetCommandLineW CloseHandle GetLastError Sleep GetCurrentProcessId TerminateProcess GetCurrentThreadId OpenProcess GetSystemDirectoryW GetSystemWow64DirectoryW GetModuleHandleW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeleteFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject WaitForMultipleObjects CreateThread QueueUserWorkItem UnregisterWaitEx LocalFree GetEnvironmentVariableW SetEnvironmentVariableW GetDriveTypeW GetTempPathW GetStartupInfoW GetTickCount SetDllDirectoryW GetDllDirectoryW CopyFileW GetSystemTime SystemTimeToFileTime GetExitCodeProcess VerSetConditionMask GetCurrentProcess LocalAlloc VerifyVersionInfoW FindClose FindFirstFileW FindNextFileW SetEvent CreateEventW CreateFileW ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW GetOverlappedResult CancelIo FlushFileBuffers ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CreateDirectoryW GetFileAttributesW ReadProcessMemory WideCharToMultiByte SetUnhandledExceptionFilter LoadLibraryExW DecodePointer RaiseException HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetFileAttributesExW GetModuleHandleExW VirtualAlloc VirtualFree lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW CreateProcessW ExpandEnvironmentStringsW GetLongPathNameW GetCurrentThread ProcessIdToSessionId SetLastError OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SetStdHandle GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetStringTypeW FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetCPInfo ResetEvent WaitForSingleObjectEx InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW RtlUnwind InterlockedPushEntrySList TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetStdHandle ExitProcess GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

dbe7b5ab569028fe3de4f9d18d6e3bfa4be7fd8e6cc9700d1bacb04a45e76f9c

kernel32

generic