f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153

Sharing

Copy URL Twitter E-mail

General

Target
f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153
Size 1.9MB
Sample261030-qsgp3syzhy
SHA256 f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153
MD5 3afa08ce991b1d60afe5199952837e38
SHA1 b3db4657917cce07ed50d8ccf0ce777f4947643d
SHA512 5b1a37d0775058a01dbc4bb8c7d3270647f43dfe2755ed3be89937159ac23867c49952e0c6278d20056115d7c215ea2d815d9068e5126dc7f91d62293981c729
SSDEEP 12288:dZjig4pPDX6oHJa1DV4//zFJixBpX4HHzCjgDxTL5CYf2YX0R:dUgKHV/zzSBuHHzCkDXb2YXE
TLSH
T15795F84563CED572D83B89FA4E156EDEA9257C40837061AF23E08C535A33B9369B93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153

File Explorer

f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153

.exe 1.9MB

f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153

IMPHASH 9bc1c743bec8cca7b6c22a7b57612114
SHA256 f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153
MD5 3afa08ce991b1d60afe5199952837e38
SHA1 b3db4657917cce07ed50d8ccf0ce777f4947643d
SHA512 5b1a37d0775058a01dbc4bb8c7d3270647f43dfe2755ed3be89937159ac23867c49952e0c6278d20056115d7c215ea2d815d9068e5126dc7f91d62293981c729
SSDEEP 12288:dZjig4pPDX6oHJa1DV4//zFJixBpX4HHzCjgDxTL5CYf2YX0R:dUgKHV/zzSBuHHzCkDXb2YXE
TLSH
T15795F84563CED572D83B89FA4E156EDEA9257C40837061AF23E08C535A33B9369B93C3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

305776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

y1I1r554ofwu4j7eeit7B5OYu86VF93wTC4wAe1h4ry192okk725jC8Dd4713e5d

kernel32

GetCurrentProcess FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryA lstrlenW GetThreadLocale K32EnumProcessModules GetStdHandle GetCommandLineW SetCurrentDirectoryW DeleteFileW GetFileAttributesW WriteFile CloseHandle GetLastError GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId SuspendThread ResumeThread CreateProcessW GetLocalTime GetModuleFileNameW GetModuleHandleW LoadLibraryW FormatMessageA WriteConsoleW SetEndOfFile HeapSize CreateFileW SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess TerminateProcess GetModuleHandleExW ReadFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetCurrentThread HeapFree HeapAlloc HeapReAlloc GetTempPathW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW RtlUnwind

user32

MessageBoxA MessageBoxW

shell32

CommandLineToArgvW

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW StrCmpW

Name

.text

Size

752KB

Virtual Size

751KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.iBXuW

Size

1024KB

Virtual Size

1024KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f4155ad7b89ab264737a33e7a857b7e4f9a7421cbaf2614614962dccff9fe153

kernel32

user32

shell32

shlwapi

generic