6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9

Sharing

Copy URL Twitter E-mail

General

Target
6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9
Size 691KB
Sample261102-jgadasfz8x
SHA256 6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9
MD5 0648c8a8d7dc61428e48a2958678ce22
SHA1 532c57c2504dd55ea3fad836d294b2ab8c5c6606
SHA512 06161cc78eb8824bd1de037d0ec1429fb32aa52d152812680780d6499c1891a30e82f9a1551f5a02398126906a39172cda6ff95330f74fc4c94a26cfa033d9ba
SSDEEP 12288:prPACimGXL+hJ06zJ/t/pXIIIvHV6dUD1NVdYVV4uqfGFQGR:prPACipL+h26zJ/thLIvHVKUD5d8Ce
TLSH
T1BEE48D2274C18073D67221328578F77686AEF9300B2527DF57D81B7AAF281C25F3666B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9

File Explorer

6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9

.exe 691KB

6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9

IMPHASH e9446c4c2c9f8e0374b76f71cd0dc0b8
SHA256 6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9
MD5 0648c8a8d7dc61428e48a2958678ce22
SHA1 532c57c2504dd55ea3fad836d294b2ab8c5c6606
SHA512 06161cc78eb8824bd1de037d0ec1429fb32aa52d152812680780d6499c1891a30e82f9a1551f5a02398126906a39172cda6ff95330f74fc4c94a26cfa033d9ba
SSDEEP 12288:prPACimGXL+hJ06zJ/t/pXIIIvHV6dUD1NVdYVV4uqfGFQGR:prPACipL+h26zJ/thLIvHVKUD5d8Ce
TLSH
T1BEE48D2274C18073D67221328578F77686AEF9300B2527DF57D81B7AAF281C25F3666B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

117815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\workspace\thunder12_cppsrc\symbols\ia32\RelWithDebInfo\InstallXLWFP.pdb

iphlpapi

GetAdaptersInfo

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA

kernel32

CreateEventW WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte CreateFileW GetLastError Sleep GetModuleHandleW GetProcAddress lstrcatA GetFileAttributesA SetEvent WritePrivateProfileStringA CreateDirectoryA GetPrivateProfileStringA SetPriorityClass GetCurrentProcess DeviceIoControl GetVolumeInformationA CreateFileA GetVersionExA FlushFileBuffers HeapSize SetFilePointerEx DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW WaitForSingleObject lstrcpyA InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FormatMessageA InitializeCriticalSectionEx EncodePointer DecodePointer LocalFree LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc GetFileType GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler OutputDebugStringW SetStdHandle HeapReAlloc GetTimeZoneInformation GetFileSizeEx WriteConsoleW

shell32

SHGetSpecialFolderPathA

advapi32

OpenServiceW RegQueryValueExW RegOpenKeyW RegCloseKey StartServiceW CloseServiceHandle OpenSCManagerW DeleteService CreateServiceW ControlService

Sharing

General

Malware Config

Signatures

File Explorer

6ef34ed729c1d2561a9258b4d0c39cb143c4de8260cb8a4a09153e0de837d9f9

iphlpapi

wininet

kernel32

shell32

advapi32

generic