14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a

General

Target
14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a
Size 196KB
Sample261101-2e3aeadw6x
SHA256 14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a
MD5 10ce8418f6260603c4697446e17e305a
SHA1 71e110fc30b83c7ba4b6103f18d53281e153d97a
SHA512 3bc6d5ed7a4897bd3c2dad06370c2c506aaea2b0208db70d13dda721b89fc4bae748e4df963fb35c561f3084842364e3d1346af2f4509a1126ba7444792496f6
SSDEEP 3072:DpR6NaN+sbPbX7f4eJG6w3Cdp7MrXSUj:1R667f4epUj
TLSH
T1E214479263FA4204FAF37F7899B812956F3A7C55AF38C1CF11A1405D89B2ED09970B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a

File Explorer

14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a

.exe 196KB

14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a

IMPHASH 7571ebaeec099f45ca9f368ec8f9d10a
SHA256 14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a
MD5 10ce8418f6260603c4697446e17e305a
SHA1 71e110fc30b83c7ba4b6103f18d53281e153d97a
SHA512 3bc6d5ed7a4897bd3c2dad06370c2c506aaea2b0208db70d13dda721b89fc4bae748e4df963fb35c561f3084842364e3d1346af2f4509a1126ba7444792496f6
SSDEEP 3072:DpR6NaN+sbPbX7f4eJG6w3Cdp7MrXSUj:1R667f4epUj
TLSH
T1E214479263FA4204FAF37F7899B812956F3A7C55AF38C1CF11A1405D89B2ED09970B63
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

18912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CharUpperBuffW LoadStringW

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _strdup _wfopen _wsplitpath _wtol exit fclose feof fgetws free fwrite getenv malloc memcpy memmove memset strchr strcmp strcpy strcspn strlen toupper wcschr wcscpy wcslen wcsrchr wcsstr

kernel32

CloseHandle CompareFileTime CompareStringW CopyFileW CreateDirectoryW CreateFileW FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FormatMessageW GetCommandLineW GetCurrentDirectoryW GetDateFormatW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileTime GetFullPathNameW GetModuleHandleW GetOEMCP GetProcAddress GetStdHandle GetTickCount GetTimeFormatW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LocalFree ReadFile SetFileAttributesW SystemTimeToFileTime WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

140KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

14611c20ce2dcbb100a1a83420e4ad13bf044ae9e5ef181bc8860ce36864985a

user32

ucrtbase

kernel32

ntdll

generic