59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86

General

Target
59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86
Size 482KB
Sample261102-e3n2cszyfz
SHA256 59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86
MD5 21747443dcb931816a96b6de6a345f2d
SHA1 e34a278af2c012dc6784590a7ee6214c22c4159c
SHA512 333d34cbeed0dcb4547f77b18aa3d25b6a5c991fa2a3fdd80845cc0544701096eea4c3506118dd33338c5db07ae86626434cd4ef2a9a493260960fc526556238
SSDEEP 6144:PpJoZ4HXC1baXFak4UVdTFbYVJ49F8ocgaKsyl2j4YlJK3f7Na8yxKO:LakXVd8Je8oc/yl2j40J4ha8eK
TLSH
T1CBB4C94BEAB651E5D4BAC0388563712BFC7134694334ABD79B809B531B72BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86

File Explorer

59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86

.exe 482KB

59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86

IMPHASH 48f475f35a8eefbe7477d1efc5eb1f0e
SHA256 59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86
MD5 21747443dcb931816a96b6de6a345f2d
SHA1 e34a278af2c012dc6784590a7ee6214c22c4159c
SHA512 333d34cbeed0dcb4547f77b18aa3d25b6a5c991fa2a3fdd80845cc0544701096eea4c3506118dd33338c5db07ae86626434cd4ef2a9a493260960fc526556238
SSDEEP 6144:PpJoZ4HXC1baXFak4UVdTFbYVJ49F8ocgaKsyl2j4YlJK3f7Na8yxKO:LakXVd8Je8oc/yl2j40J4ha8eK
TLSH
T1CBB4C94BEAB651E5D4BAC0388563712BFC7134694334ABD79B809B531B72BE4E93E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

284236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

EnumLanguageGroupLocalesW GetThreadIdealProcessorEx GetSystemDefaultUILanguage Wow64SetThreadContext CreateConsoleScreenBuffer SetSystemTime FlsGetValue CreateHardLinkW GetLocaleInfoW GetUILanguageInfo GetVolumeNameForVolumeMountPointW VerifyScripts WaitForThreadpoolWaitCallbacks CreateHardLinkTransactedW PowerClearRequest SetCurrentDirectoryW VirtualAllocEx ExitProcess GetNumberOfConsoleInputEvents GetProcessGroupAffinity SetDllDirectoryW WriteConsoleOutputW InitializeSynchronizationBarrier SetProcessPriorityBoost SetSystemTimeAdjustment GetBinaryTypeW CreateDirectoryTransactedW HeapFree ExpandEnvironmentStringsW SetConsoleMode GetProfileIntW GetUserDefaultLocaleName GetNamedPipeClientComputerNameW UnregisterApplicationRecoveryCallback IsBadCodePtr SetProcessMitigationPolicy GetPrivateProfileStringW Sleep LCMapStringEx SetThreadpoolThreadMaximum GetCommState InterlockedPushListSListEx LoadLibraryW GetActiveProcessorCount HeapAlloc AddSIDToBoundaryDescriptor SetFirmwareEnvironmentVariableW MoveFileExW GetOverlappedResultEx SetThreadpoolStackInformation GetVolumePathNamesForVolumeNameW ConvertFiberToThread InterlockedPushEntrySList SetThreadContext FindNextStreamW InterlockedPopEntrySList GetStartupInfoW CreateNamedPipeW GetVersionExW BuildCommDCBAndTimeoutsW CloseHandle GetCurrentProcessId GetProcessHeap CreateMailslotW GlobalUnlock EnterSynchronizationBarrier BackupWrite SetConsoleCtrlHandler GetLogicalDrives GetThreadPriorityBoost QueryInformationJobObject CloseThreadpool GetFileSizeEx SearchPathW IsBadWritePtr CompareStringW CreateTapePartition lstrlenW EnumCalendarInfoW UnregisterWait OutputDebugStringA GetProcessIdOfThread GetModuleFileNameW GetGeoInfoW GetProductInfo SetSystemFileCacheSize PeekNamedPipe GetConsoleScreenBufferInfoEx SetSearchPathMode UnmapViewOfFile GetLastError EnumSystemLocalesEx CloseThreadpoolTimer EnumDateFormatsExEx OpenSemaphoreW GetNativeSystemInfo IsDBCSLeadByte ClearCommError CloseThreadpoolIo UnlockFile SetThreadPriorityBoost SetThreadStackGuarantee SetDefaultCommConfigW DeleteVolumeMountPointW OpenMutexW SetTapePosition GetExitCodeProcess EnumResourceTypesExW RtlUnwind SetWaitableTimer GetLongPathNameW GetCurrentProcess DeleteTimerQueue RegisterWaitForSingleObject SetFileTime AddSecureMemoryCacheCallback WaitForMultipleObjects TryAcquireSRWLockShared EnumResourceNamesW CreateBoundaryDescriptorW EnumCalendarInfoExW GetCommMask GetFileAttributesTransactedW WaitForThreadpoolWorkCallbacks HeapWalk GetACP OpenProcess SwitchToFiber GetLogicalDriveStringsW TzSpecificLocalTimeToSystemTime GetFileAttributesExW GetThreadUILanguage TerminateThread GetSystemInfo Wow64SuspendThread SetVolumeMountPointW ReadDirectoryChangesW VirtualLock UnregisterApplicationRestart FindAtomW DisableThreadProfiling GetThreadTimes GetTempFileNameW GetThreadGroupAffinity ConvertThreadToFiber VirtualQuery OpenThread AreFileApisANSI ReadFile WriteProfileStringW QueryThreadpoolStackInformation GetOEMCP GetConsoleOutputCP GetStdHandle SetProcessShutdownParameters GetNumaProcessorNodeEx InitializeCriticalSectionEx UnregisterBadMemoryNotification DisconnectNamedPipe ApplicationRecoveryInProgress PowerCreateRequest BuildCommDCBW GetProcessPreferredUILanguages UpdateResourceW GetNamedPipeClientSessionId CreateFileMappingFromApp SetConsoleCP SetThreadExecutionState GetConsoleWindow DeleteTimerQueueTimer EnumSystemFirmwareTables lstrcmpW GetCurrentConsoleFont CreateFileW GetConsoleMode FlushFileBuffers HeapSize SetFilePointerEx SetStdHandle QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW WriteFile HeapReAlloc GetFileType FlsAlloc FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Sharing

General

Malware Config

Signatures

File Explorer

59c65308a57f904ea72d5015e4b5aeab384b2e4c425f40ccc03ac32c410acf86

kernel32

ntdll

generic