6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae

Sharing

Copy URL Twitter E-mail

General

Target
6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae
Size 74KB
Sample261102-e3spjsey6z
SHA256 6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae
MD5 a1e0c9931247a5826f2747278cc583aa
SHA1 a30632911422c8cd532c9e0a8f9237f74a795ac5
SHA512 0cc31c1c40d0c731f1d8ccb59f396ab21adec0dacf15e2f45293e4341448789328d207f4571b76efd85181e4904ec9f9691b57dce55a0d35abbba0ac0414076e
SSDEEP 1536:qjPQiJjcVEttj15pLz9I4axfp6pONIJlpKIZLmd6r0m/NgZ:qjPQiJjccj1hI4aJp6pKxd6rlVgZ
TLSH
T17E735B0BB39394FCC51BC17583A69672DB70F86505306FAF2B58CB361E20E616F2DA49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae

File Explorer

6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae

.exe 74KB

6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae

IMPHASH 8065bef81c3886c5758c476579325e1b
SHA256 6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae
MD5 a1e0c9931247a5826f2747278cc583aa
SHA1 a30632911422c8cd532c9e0a8f9237f74a795ac5
SHA512 0cc31c1c40d0c731f1d8ccb59f396ab21adec0dacf15e2f45293e4341448789328d207f4571b76efd85181e4904ec9f9691b57dce55a0d35abbba0ac0414076e
SSDEEP 1536:qjPQiJjcVEttj15pLz9I4axfp6pONIJlpKIZLmd6r0m/NgZ:qjPQiJjccj1hI4aJp6pKxd6rlVgZ
TLSH
T17E735B0BB39394FCC51BC17583A69672DB70F86505306FAF2B58CB361E20E616F2DA49
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

gdi32

CreateFontW DeleteObject SelectObject SetBkMode SetTextColor

kernel32

CloseHandle CreateDirectoryA CreateFileA CreateMutexW CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection GetComputerNameA GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess GetFileAttributesA GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTickCount64 InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar ReadFile SetFilePointer SetHandleInformation SetUnhandledExceptionFilter Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _initterm _stricmp _strnicmp _strtoi64 _strtoui64 _time64 abort atexit atoi calloc exit fprintf fputc free getenv localeconv malloc memcmp memcpy rand signal srand strcat strchr strcmp strcpy strerror strlen strncmp strrchr strstr strtoul vfprintf wcslen

user32

BeginPaint CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetMessageW GetSysColor GetSysColorBrush LoadCursorW PostMessageW PostQuitMessage PostThreadMessageW RegisterClassExW TranslateMessage

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo recv select send setsockopt socket

Name

.text

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6e9ba2c6811200336a228171b3b386c814ec9b4b13e63e3b0c00b609e8d67fae

bcrypt

gdi32

kernel32

msvcrt

user32

ws2_32

generic