5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4

Sharing

Copy URL Twitter E-mail

General

Target
5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4
Size 188KB
Sample261101-1dbkmadc98
SHA256 5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4
MD5 8fddc6e8e7fe1811dcbdf271fbdd7e9e
SHA1 44a17493a65be58cb498ba3277b16e831579704e
SHA512 aa41374ad2e4daccdfed4d640a47d7c3d971473a7891d609b481e730f11e1a036fb5a559f7c990eeecfba556154de5239f2d53bea40e9ee38efce89ed7d1a508
SSDEEP 1536:tR+teHIQktxMzcbPRHZ1Rr8JtytutCX6AQjR1ste4jX8//KPFDH3IJm8:tRxHIQkjscNHZ1Rss6PPCs/3m8
TLSH
T115142815A7957B9FEC7783B969E22326733AB90017336BCB02410E394D76BD19D38782
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4

File Explorer

5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4

.exe 188KB

5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4

IMPHASH d7284a431df31b25a2a684dacddd6171
SHA256 5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4
MD5 8fddc6e8e7fe1811dcbdf271fbdd7e9e
SHA1 44a17493a65be58cb498ba3277b16e831579704e
SHA512 aa41374ad2e4daccdfed4d640a47d7c3d971473a7891d609b481e730f11e1a036fb5a559f7c990eeecfba556154de5239f2d53bea40e9ee38efce89ed7d1a508
SSDEEP 1536:tR+teHIQktxMzcbPRHZ1Rr8JtytutCX6AQjR1ste4jX8//KPFDH3IJm8:tRxHIQkjscNHZ1Rss6PPCs/3m8
TLSH
T115142815A7957B9FEC7783B969E22326733AB90017336BCB02410E394D76BD19D38782
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

UuidCreate

user32

AdjustWindowRect AppendMenuW BeginPaint ChangeDisplaySettingsExW ClientToScreen ClipCursor CopyIcon CreateDesktopW CreateIcon CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawCaptionTempW DrawFrameControl DrawIconEx DrawTextW EndPaint EnumDisplayDevicesW EnumDisplaySettingsExW ExitWindowsEx GetAncestor GetClientRect GetDC GetDesktopWindow GetForegroundWindow GetMenuInfo GetMenuItemCount GetMenuItemInfoW GetMessageW GetProcessWindowStation GetSystemMetrics GetThreadDesktop GetUserObjectInformationW GetWindow GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowThreadProcessId InsertMenuItemW IntersectRect InvalidateRect IsIconic IsWindowEnabled IsWindowVisible KillTimer LoadCursorA LoadCursorW LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PaintDesktop PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW ReleaseDC SendMessageW SendNotifyMessageW SetCursor SetForegroundWindow SetMenuInfo SetMenuItemInfoW SetParent SetShellWindow SetThreadDesktop SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SubtractRect SystemParametersInfoW TrackPopupMenuEx TranslateMessage UnregisterClassW UpdateLayeredWindow UpdateWindow

gdi32

CreateCompatibleDC CreateDIBSection CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetTextExtentPointA GetTextExtentPointW GetTextMetricsW SelectObject SetBkMode SetTextColor

advapi32

RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

win32u

NtUserMessageCall

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf _assert _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _strdup _wcsicmp _wcsnicmp calloc exit free fwrite getenv iswspace malloc memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen wcschr wcscmp wcscpy wcslen wcstoul

kernel32

CloseHandle CompareStringW CreateEventW CreateFileW CreateMutexW CreateProcessW CreateThread DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetFullPathNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetStartupInfoW GetTickCount HeapAlloc HeapReAlloc InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW MapViewOfFile MulDiv MultiByteToWideChar OpenProcess ReadDirectoryChangesW ResolveDelayLoadedAPI SetThreadDescription UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject lstrcmpiW

ntdll

NtSetInformationProcess _vsnprintf

Name

.text

Size

64KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

636B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5463bc3ad2a13b83a03927709790ea754e3ca6975dbeb8146ab77a5bb6a8e5d4

rpcrt4

user32

gdi32

advapi32

win32u

ucrtbase

kernel32

ntdll

generic