458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a

Sharing

Copy URL Twitter E-mail

General

Target
458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a
Size 395KB
Sample261102-e5f4jasw3q
SHA256 458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a
MD5 bf0ace1917afadd71d7d6ee7fd8f36f9
SHA1 b2e10b8d4bad325aa06ea0363722fa871c9f8bc1
SHA512 ccf77fe983c7c8b4d71e6d3ef0e0c075d9c51fab38aab1077ed59cdb651c0fb3520ee312a1eabce8b6a59d87257aef2d3eeba9d3cdc88448b8ba796bd0de3275
SSDEEP 6144:QtOgNyfzSRli+3BGRpkX5F/6ceTAz5gExF0m64cyTOWf+m0zY3:1yiiwkohO+gcyTOw
TLSH
T107846D16E7D800F9E1B7D178CD968902E7727C5E0771A6DF13A44AA61F23AD08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a

File Explorer

458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a

.exe 395KB

458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a

IMPHASH c7dca308494b7d186d3685c11093fa67
SHA256 458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a
MD5 bf0ace1917afadd71d7d6ee7fd8f36f9
SHA1 b2e10b8d4bad325aa06ea0363722fa871c9f8bc1
SHA512 ccf77fe983c7c8b4d71e6d3ef0e0c075d9c51fab38aab1077ed59cdb651c0fb3520ee312a1eabce8b6a59d87257aef2d3eeba9d3cdc88448b8ba796bd0de3275
SSDEEP 6144:QtOgNyfzSRli+3BGRpkX5F/6ceTAz5gExF0m64cyTOWf+m0zY3:1yiiwkohO+gcyTOw
TLSH
T107846D16E7D800F9E1B7D178CD968902E7727C5E0771A6DF13A44AA61F23AD08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

161824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider

user32

SetProcessDpiAwarenessContext MessageBoxW

advapi32

RegGetValueW

shell32

ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize

kernel32

WriteConsoleW HeapSize GetProcessHeap SetEndOfFile FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA SetStdHandle LCMapStringEx GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetCommandLineW CreateFileW CloseHandle GetCurrentProcessId GetModuleFileNameW SetDefaultDllDirectories LocalFree GetFileAttributesW ReadFile GetSystemTimeAsFileTime MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW GetConsoleMode FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress CopyFileW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapReAlloc HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP

Name

.text

Size

268KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

458590617aa93bccac21572088f38d1eff010dac34d8e5aa33074f5d4879790a

bcrypt

user32

advapi32

shell32

ole32

kernel32

generic