bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357

Sharing

Copy URL Twitter E-mail

General

Target
bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357
Size 514KB
Sample261102-jp3ptaat5m
SHA256 bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357
MD5 23370f703612cd9887c28901b2452865
SHA1 8e7c23225f0463cae4110a6dd05687de9b9f2a51
SHA512 daf8b2526c7ed4c1697e47c716222a0b67674203f3e7efd13fa612a8822b7ce26d1457cb80a871b83595f292262eaf8b2f7fadb18d5be81925e80b1b32ff3a96
SSDEEP 12288:Z0lDmBRGWAOLV9/0N34sxl2SnR3XtynqD:WlDWRGaLr8N34sxl2SnR3XtynqD
TLSH
T140B44A84EAC365F3ED474A7081A7F7BFAB349600C075CE75CA5CD994ED63A33512A228
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357

File Explorer

bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357

.exe 514KB

bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357

IMPHASH 75762e003a93e87c740502d3bd3f4170
SHA256 bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357
MD5 23370f703612cd9887c28901b2452865
SHA1 8e7c23225f0463cae4110a6dd05687de9b9f2a51
SHA512 daf8b2526c7ed4c1697e47c716222a0b67674203f3e7efd13fa612a8822b7ce26d1457cb80a871b83595f292262eaf8b2f7fadb18d5be81925e80b1b32ff3a96
SSDEEP 12288:Z0lDmBRGWAOLV9/0N34sxl2SnR3XtynqD:WlDWRGaLr8N34sxl2SnR3XtynqD
TLSH
T140B44A84EAC365F3ED474A7081A7F7BFAB349600C075CE75CA5CD994ED63A33512A228
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gdi32

DeleteDC ExtTextOutA GetTextExtentPoint32A SelectObject SetBkColor SetTextColor

kernel32

CloseHandle ConnectNamedPipe CreateEventA CreateFileA CreateFileMappingA CreateMutexA CreateNamedPipeA CreateThread DeleteCriticalSection EnterCriticalSection FindClose FindFirstFileA FormatMessageA FreeLibrary GetACP GetCPInfo GetCommandLineW GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetStartupInfoA GetSystemDirectoryA GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingA OpenProcess QueryPerformanceCounter ReadFile ReleaseMutex SetCurrentDirectoryA SetCurrentDirectoryW SetEvent SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WaitNamedPipeA WideCharToMultiByte WriteFile

msvcrt

gmtime ___mb_cur_max_func __getmainargs __initenv __lconv_init __p__acmdln __p__fmode __set_app_type __setusermatherr _amsg_exit _cexit _errno _exit _initterm _iob _lock _onexit _snwprintf _strdup _strnicmp _unlock _wfopen abort atoi calloc exit fclose ferror fgetc fprintf fputc fputs fread free fwprintf fwrite getc getenv isalnum islower isspace isupper isxdigit localeconv malloc memchr memcmp memcpy memmove memset raise realloc remove setlocale signal strchr strcmp strcpy strcspn strerror strftime strlen strncmp strncpy strrchr strspn strstr strtol strtoul tolower toupper ungetc vfprintf wcscmp wcscpy wcslen wcsncpy

shell32

ShellExecuteA

advapi32

AllocateAndInitializeSid CopySid CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptHashData CryptReleaseContext CryptSignHashA EqualSid GetCurrentHwProfileA GetLengthSid GetUserNameA InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner

comdlg32

GetOpenFileNameA GetOpenFileNameW GetSaveFileNameA GetSaveFileNameW

user32

CreateDialogParamA CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA DrawFocusRect EnableWindow EndDialog FindWindowA GetDC GetDesktopWindow GetDlgItem GetMessageA GetSysColor GetWindowLongA GetWindowRect GetWindowTextA GetWindowTextLengthA GetWindowTextLengthW GetWindowTextW IsDialogMessageA IsWindow LoadIconA MapDialogRect MessageBeep MessageBoxA MessageBoxIndirectW MessageBoxW MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageA PostQuitMessage RegisterClassA RegisterWindowMessageA SendDlgItemMessageA SendMessageA SendMessageTimeoutA SetActiveWindow SetDlgItemTextA SetForegroundWindow SetWindowLongA SetWindowPos ShowWindow TabbedTextOutA TranslateMessage

Name

.text

Size

410KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

bafa73bd69fb861a8f5ebbfefde6d8368465f4ff2944fbb8ce8ec68f65694357

gdi32

kernel32

msvcrt

shell32

advapi32

comdlg32

user32

generic