51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387

Sharing

Copy URL Twitter E-mail

General

Target
51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387
Size 1.6MB
Sample261102-bvg2aset3z
SHA256 51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387
MD5 0e46482009bdf447d3b28d1197fdf5db
SHA1 e08f6f72b0921a692b4d7305c1c8a71c29656cc0
SHA512 beae23c410c3d0a335c7bc12471efd5c065a46789cd02e6c843e1b7e693083bfdcf3fecd786bd94fba64ce632035e010b307da2a9d21c367bc8cf586118fdb16
SSDEEP 24576:tZxnGbxpZ3eO89WNcG22+xItsWE4i2m6CcG7m1JPUUYpEQs:tZBwUO89QcG2ytwkCc6YdUUYpRs
TLSH
T1DF85AE16B6A401FDD1B7D0B8CA574507EBB2780A03359FEB03D096662F27AE45E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387

File Explorer

51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387

.exe 1.6MB

51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387

IMPHASH b75a34a2ff7cdb53366f6639d3bf68d6
SHA256 51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387
MD5 0e46482009bdf447d3b28d1197fdf5db
SHA1 e08f6f72b0921a692b4d7305c1c8a71c29656cc0
SHA512 beae23c410c3d0a335c7bc12471efd5c065a46789cd02e6c843e1b7e693083bfdcf3fecd786bd94fba64ce632035e010b307da2a9d21c367bc8cf586118fdb16
SSDEEP 24576:tZxnGbxpZ3eO89WNcG22+xItsWE4i2m6CcG7m1JPUUYpEQs:tZBwUO89QcG2ytwkCc6YdUUYpRs
TLSH
T1DF85AE16B6A401FDD1B7D0B8CA574507EBB2780A03359FEB03D096662F27AE45E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

662400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile WritePrivateProfileStringW UnmapViewOfFile CreateFileMappingW MapViewOfFile Sleep GetCurrentProcessId LoadLibraryW GetProcAddress GetModuleHandleA LoadLibraryA InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW DecodePointer GetModuleFileNameW HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetTempPathW WaitNamedPipeW ReadFile GetPrivateProfileStringW CreateFileW FindResourceW LoadResource SizeofResource LockResource LoadLibraryExW GetFileAttributesW FreeLibrary GetProcessTimes GetSystemTimeAsFileTime IsWow64Process SetLastError LocalFree FormatMessageW QueryFullProcessImageNameW GetFileSizeEx ResumeThread WaitForSingleObject CreateDirectoryW SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetLastError CloseHandle MultiByteToWideChar GetCurrentProcess WideCharToMultiByte GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileType GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter RtlUnwind

user32

SetProcessDPIAware MessageBoxW MessageBoxA

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHCreateDirectoryExW SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData

mscoree

CLRCreateInstance

winmm

PlaySoundW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

845KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

527KB

Virtual Size

526KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

51ce3e2220738a81923faec339f65d5bd8599ee835590bff2bc48a94c9ec3387

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

winmm

version

api-ms-win-core-synch-l1-2-0

generic