6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72

Sharing

Copy URL Twitter E-mail

General

Target
6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72
Size 1.5MB
Sample261102-hdtr4aed32
SHA256 6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72
MD5 17ae2fa9846e33c549f890095b8406f3
SHA1 d30a3decdfb85a9197daa64608de0e3b41fecc89
SHA512 7f6bf8c299959c48fbbd6a11efad65be3414da7a38d97f017039fb9528f93481e43c351e5d44b1d1349b8a3d570daefe57b6931d0a8b8ee5c588bb1de9964ceb
SSDEEP 49152:gjHCLz/tChOa7/bOqnuCaThOlciSexvI:KCH/tCVzOq+T8rSex
TLSH
T18975D031B542C036E9A301B29AFC9BAFA13CA9610BB704D7D7C81A2D6E745D23B33557
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72

File Explorer

6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72

.exe 1.5MB

6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72

IMPHASH d1e02b1fd1701c70728c6e31a2716ee2
SHA256 6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72
MD5 17ae2fa9846e33c549f890095b8406f3
SHA1 d30a3decdfb85a9197daa64608de0e3b41fecc89
SHA512 7f6bf8c299959c48fbbd6a11efad65be3414da7a38d97f017039fb9528f93481e43c351e5d44b1d1349b8a3d570daefe57b6931d0a8b8ee5c588bb1de9964ceb
SSDEEP 49152:gjHCLz/tChOa7/bOqnuCaThOlciSexvI:KCH/tCVzOq+T8rSex
TLSH
T18975D031B542C036E9A301B29AFC9BAFA13CA9610BB704D7D7C81A2D6E745D23B33557
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

582698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\data\landun\workspace\p-3d7f88f5f52b43179dd219a5c6dd1b5c\src\bin\Release_Win32\launcher_server.pdb

kernel32

WriteFile GetModuleFileNameW CreateFileW GetLastError OutputDebugStringW DeleteFileW CloseHandle GetLocalTime GetCurrentDirectoryW GetCurrentProcessId FormatMessageA GetTickCount GetProcAddress GetModuleHandleW CreateMutexW ReadFile GetFileSizeEx TlsSetValue VirtualFree GetStdHandle VirtualAlloc TerminateProcess FindClose WaitForSingleObject GetCurrentThreadId Sleep SetEvent GetCurrentThread TlsAlloc QueryPerformanceFrequency ResetEvent TlsGetValue TlsFree QueryPerformanceCounter VirtualQuery ReleaseSRWLockExclusive CreateEventW GetCurrentProcess SetThreadPriority DuplicateHandle GetThreadPriority RaiseException CreateThread GetThreadId IsDebuggerPresent LoadLibraryW FreeLibrary LoadLibraryExW MultiByteToWideChar WideCharToMultiByte GetCommandLineW LocalFree QueryThreadCycleTime GetSystemTimeAsFileTime lstrlenW RtlCaptureStackBackTrace SetUnhandledExceptionFilter GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort TryAcquireSRWLockExclusive AcquireSRWLockExclusive CreateDirectoryW RemoveDirectoryW GetTempPathW GetFileAttributesW SetFileAttributesW GetFileAttributesExW SetCurrentDirectoryW MoveFileExW CopyFileW ReleaseMutex GetWindowsDirectoryW ExpandEnvironmentStringsW SetEndOfFile SetFilePointerEx FlushFileBuffers SetLastError GetNativeSystemInfo OpenMutexW GetProcessTimes FindFirstFileExW FindNextFileW SetEnvironmentVariableW GetEnvironmentVariableW GetUserDefaultLangID WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable SleepConditionVariableSRW FormatMessageW HeapFree GetProcessHeap HeapAlloc WaitForSingleObjectEx InitializeSRWLock EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringEx GetCPInfo GetStringTypeW InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind GetConsoleOutputCP GetConsoleMode GetModuleHandleExW ReadConsoleW GetFileType GetDriveTypeW SetStdHandle ExitProcess GetFullPathNameW HeapReAlloc HeapSize LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GlobalFree GlobalAlloc SetFilePointer CreateProcessW ConnectNamedPipe GetNamedPipeInfo CreateNamedPipeW CancelIo GetVersionExW GetFileSize InitializeCriticalSection DeviceIoControl lstrcatW lstrcpyA lstrcatA lstrcpyW lstrlenA LocalAlloc GetLogicalDriveStringsW InitializeCriticalSectionEx GetSystemDirectoryW SetErrorMode

psapi

GetProcessMemoryInfo

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ws2_32

WSAStartup

dbghelp

SymGetSearchPathW SymGetLineFromAddr64 SymSetSearchPathW SymFromAddr SymSetOptions SymInitialize

winmm

timeEndPeriod timeBeginPeriod timeGetTime

shlwapi

PathMatchSpecW

user32

DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW SetWindowLongW SetProcessDPIAware FindWindowExW DefWindowProcW GetSystemMetrics KillTimer GetWindowLongW TranslateMessage GetQueueStatus MsgWaitForMultipleObjectsEx PeekMessageW SetTimer DispatchMessageW PostMessageW IsWindow SetRectEmpty wsprintfW IsCharAlphaNumericA wvsprintfW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW GetSecurityDescriptorSacl SetSecurityDescriptorSacl SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW AddAccessAllowedAceEx GetLengthSid RegOpenKeyW RegQueryValueExW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl RegCloseKey EventUnregister EventRegister EventWrite

shell32

CommandLineToArgvW SHAppBarMessage SHGetKnownFolderPath SHGetFolderPathW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx

Sharing

General

Malware Config

Signatures

File Explorer

6a584261a391144a4aa08f1f88851409cb976c2e71a8652867c65ad859acaf72

kernel32

psapi

version

ws2_32

dbghelp

winmm

shlwapi

user32

advapi32

shell32

ole32

generic