d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead

General

Target
d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead
Size 5.7MB
Sample261101-dz82pasvht
SHA256 d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead
MD5 f143748b0b93ee652bc020c2aac60f73
SHA1 9741da8e08813e27591b31e44a6715125588daf6
SHA512 74b44c1d818dd4d07218f6afb06697f0cc521bbe8dd61c6d27da73ee2767914ad28eafcea9f34fb79649a829e066c004c8999d075f45dd449eb545c87ba3b69c
SSDEEP 98304:jtS/VIU7tRSoy6ThzqR44za4SxpweHECY7tNbq5/K0xTQWj:ouEY2pwevY7toxK0RQk
TLSH
T12656C011F685C5B1F5D201B0597AEB7A983DAE24573088C7A7D02E2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead

File Explorer

d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead

.exe 5.7MB

d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead

IMPHASH 07ed55193013a62d6372c91fb71ad68d
SHA256 d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead
MD5 f143748b0b93ee652bc020c2aac60f73
SHA1 9741da8e08813e27591b31e44a6715125588daf6
SHA512 74b44c1d818dd4d07218f6afb06697f0cc521bbe8dd61c6d27da73ee2767914ad28eafcea9f34fb79649a829e066c004c8999d075f45dd449eb545c87ba3b69c
SSDEEP 98304:jtS/VIU7tRSoy6ThzqR44za4SxpweHECY7tNbq5/K0xTQWj:ouEY2pwevY7toxK0RQk
TLSH
T12656C011F685C5B1F5D201B0597AEB7A983DAE24573088C7A7D02E2A88312D37A37F5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

3090247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

H:\rc_v12_onl_i18_202606\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb

kernel32

SetEnvironmentVariableW SetUnhandledExceptionFilter HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap GetSystemDirectoryW GetWindowsDirectoryW FindResourceExW FreeLibrary GetModuleFileNameW GetProcAddress LoadResource LockResource SizeofResource SetDefaultDllDirectories FindResourceW LoadLibraryW SetDllDirectoryW CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetTickCount GetModuleHandleW VerSetConditionMask GetCommandLineW ExpandEnvironmentStringsA CreateDirectoryW CreateFileW DeleteFileW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetShortPathNameW GetTempFileNameW SetFileTime WriteFile GetTempPathW OutputDebugStringA GetLastError SetLastError CreateMutexW OpenMutexW TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetSystemTimeAsFileTime GetVersionExW ReadProcessMemory GetModuleHandleA GetModuleHandleExW VerifyVersionInfoW GetTimeZoneInformation GetDateFormatW GetTimeFormatW MultiByteToWideChar WideCharToMultiByte GetLocaleInfoW GetGeoInfoW GetUserGeoID GetUserDefaultUILanguage CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetNativeSystemInfo GetSystemWow64DirectoryW GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetCurrentProcess GetCurrentThread LocalFree GetFileAttributesW GetFileSizeEx GetCurrentThreadId GetProcessId GlobalMemoryStatusEx GetFileInformationByHandle GetFileSize ReadFile SetFilePointer GetLocalTime CreateFileMappingW MapViewOfFile UnmapViewOfFile FileTimeToSystemTime SystemTimeToFileTime VirtualAlloc ExitProcess FreeResource DecodePointer RaiseException InitializeCriticalSectionAndSpinCount CreateFileA DeviceIoControl CreateThread ExpandEnvironmentStringsW ProcessIdToSessionId WTSGetActiveConsoleSessionId GetEnvironmentVariableW CreateProcessW GetLongPathNameW SetEvent ResetEvent ReleaseSemaphore CreateEventW CreateSemaphoreW SystemTimeToTzSpecificLocalTime ReleaseMutex WaitForMultipleObjects VirtualQuery OpenFileMappingW OutputDebugStringW GetProcessTimes GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree SwitchToFiber DeleteFiber CreateFiber FormatMessageW QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber LoadLibraryA FindClose FindFirstFileW FindNextFileW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW QueryPerformanceFrequency GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime PeekNamedPipe InitializeConditionVariable WakeAllConditionVariable CreateEventA RegisterWaitForSingleObject UnregisterWait CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus SetFileCompletionNotificationModes GetACP GetCurrentDirectoryW MulDiv GlobalAlloc GlobalUnlock GlobalLock DuplicateHandle DosDateTimeToFileTime GetEnvironmentStringsW GetSystemInfo VirtualProtect LoadLibraryExA IsDebuggerPresent GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx MoveFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx CompareStringEx GetCPInfo WaitForSingleObjectEx InitializeSListHead UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW RtlUnwind InterlockedPushEntrySList LoadLibraryExW GetCommandLineA ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler WriteConsoleW GetConsoleCP CompareStringW LCMapStringW IsValidLocale EnumSystemLocalesW FlushFileBuffers SetStdHandle IsValidCodePage GetOEMCP FreeEnvironmentStringsW

Sharing

General

Malware Config

Signatures

File Explorer

d8d1af70a99199fc73867dea020cf02f3f08c6e6ac7d0a8f3c7a6b6c950f8ead

kernel32

generic