1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2

General

Target
1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2
Size 2.5MB
Sample261102-kcx48sty4j
SHA256 1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2
MD5 65336289678de663e949905932095a62
SHA1 8cb3fc61d819c3ccd5f9d1a7fe93bd20587086ff
SHA512 e0c0686a42693004bdeda4fbb6514a82ecef1c72e4f8c55e1ec9ec3d84883b6ebf2d10b7f19139ffe72018ed9ddf1f90e8105189800af561c92f8616534aca7b
SSDEEP 49152:mH9i9wRViu+XTI8Md8ZaYD2oaiHad+Cuww340Q+m7ncKQqHy:u0aRsbMpiXsBkC6QDrQqH
TLSH
T184C51263B85AA446CCBE6634CDC1CB76CD38EDE04B4149EF721B2A5D94702E386A7374
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2

File Explorer

1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2

.exe 2.5MB

1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2

IMPHASH c2f5cd0ad5bcfb8ae447a31c93f3365b
SHA256 1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2
MD5 65336289678de663e949905932095a62
SHA1 8cb3fc61d819c3ccd5f9d1a7fe93bd20587086ff
SHA512 e0c0686a42693004bdeda4fbb6514a82ecef1c72e4f8c55e1ec9ec3d84883b6ebf2d10b7f19139ffe72018ed9ddf1f90e8105189800af561c92f8616534aca7b
SSDEEP 49152:mH9i9wRViu+XTI8Md8ZaYD2oaiHad+Cuww340Q+m7ncKQqHy:u0aRsbMpiXsBkC6QDrQqH
TLSH
T184C51263B85AA446CCBE6634CDC1CB76CD38EDE04B4149EF721B2A5D94702E386A7374
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\src\_LdsCode\sysloader\sysloader-inst-uninst\bin\Inst\Release\Install.pdb

kernel32

InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess TerminateProcess ExitThread FreeLibrary GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte CreateThread DecodePointer WaitForSingleObject FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindFirstFileExW GetConsoleMode GetConsoleOutputCP SetFilePointerEx LCMapStringW GetStdHandle ExitProcess GetFileType SetStdHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentProcessId GetSystemTimeAsFileTime QueryPerformanceCounter VirtualQuery CloseHandle GetCurrentThreadId FindNextFileW FindClose GetModuleFileNameW InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection EncodePointer GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException WriteConsoleW GetModuleHandleExW GetOEMCP GetACP GetCommandLineW CreateFileW CancelSynchronousIo WriteFile FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

user32

RegisterWindowMessageW

Sharing

General

Malware Config

Signatures

File Explorer

1bd43bd77febbb419ebb51b9feb75f54e979c2a2ddf640f1913568f0c448fcd2

kernel32

user32

generic