83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b

General

Target
83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b
Size 226KB
Sample261102-cz2rya117k
SHA256 83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b
MD5 2ed5c50c0352106ebadcccb41eb49492
SHA1 47416f5f8550dbb0d54b458b6b26eb711ad593b8
SHA512 fd9768caafad0fece96cca4c5f951fd62e369af48ca611f4c3a67b81ec951d162ef493d53da45a295c2434ba1fb5eba1b94504bcb404c95428f4f7f87efa26d8
SSDEEP 6144:m6hbBKx1vWHiQC97bSJcnwJZp1lHahoVpa3EJ:vYLNwJZTAA6EJ
TLSH
T177347D06B79510FDE16BD678C9420941FB73BC4A07B09ADF47904AB59E237D09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b

File Explorer

83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b

.exe 226KB

83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b

IMPHASH 1e4378f1f2ac29338af86b7a63e9c98f
SHA256 83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b
MD5 2ed5c50c0352106ebadcccb41eb49492
SHA1 47416f5f8550dbb0d54b458b6b26eb711ad593b8
SHA512 fd9768caafad0fece96cca4c5f951fd62e369af48ca611f4c3a67b81ec951d162ef493d53da45a295c2434ba1fb5eba1b94504bcb404c95428f4f7f87efa26d8
SSDEEP 6144:m6hbBKx1vWHiQC97bSJcnwJZp1lHahoVpa3EJ:vYLNwJZTAA6EJ
TLSH
T177347D06B79510FDE16BD678C9420941FB73BC4A07B09ADF47904AB59E237D09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

45444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

CommandLineToArgvW

user32

FindWindowExW GetWindowThreadProcessId

kernel32

EnterCriticalSection WriteConsoleW GetConsoleMode GetCommandLineW CreateFileW WriteFile CloseHandle GetLastError SetEvent WaitForSingleObject CreateMutexW OpenMutexW OpenEventW Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetProcessId OpenProcess GetLocalTime LocalFree QueryFullProcessImageNameW CompareStringOrdinal WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetLastError MoveFileExW GetConsoleOutputCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers

Name

.text

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

83c5eb9004eba6538aed714ab3464604ecce362b7b9e831ded61970196c4fd0b

shell32

user32

kernel32

generic