70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6

Sharing

Copy URL Twitter E-mail

General

Target
70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6
Size 99KB
Sample261102-mkcjlsvt6m
SHA256 70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6
MD5 c77b405f21b58ecd7adf349d82192bbc
SHA1 1378ffcf1dd1b13d6aee1d7b4ee9e0ad2719183b
SHA512 8fd7a6c932e353a8675c338675014dd71287afa0a3c576f681df7611cd7bb078ff02508130dfe47f9e956bacc937d4000e3f1258731c522597cbc1143f25d44b
SSDEEP 1536:vX1RAfCWPhrY3bUM/hdJ7OahgtQLvYmQR6r0H4WBC6Kg8j6Z8bhZ5qQ/9y4:vzAfCWZmj/hgtQmR6rbnNjrjqA04
TLSH
T1F3A3094137E921F8E6BBE674C9725512E77AB4311B3193DF0220895A1F23BE1ED39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6

File Explorer

70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6

.exe 99KB

70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6

IMPHASH 95a78fee046de1495410380f06d272e1
SHA256 70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6
MD5 c77b405f21b58ecd7adf349d82192bbc
SHA1 1378ffcf1dd1b13d6aee1d7b4ee9e0ad2719183b
SHA512 8fd7a6c932e353a8675c338675014dd71287afa0a3c576f681df7611cd7bb078ff02508130dfe47f9e956bacc937d4000e3f1258731c522597cbc1143f25d44b
SSDEEP 1536:vX1RAfCWPhrY3bUM/hdJ7OahgtQLvYmQR6r0H4WBC6Kg8j6Z8bhZ5qQ/9y4:vzAfCWZmj/hgtQmR6rbnNjrjqA04
TLSH
T1F3A3094137E921F8E6BBE674C9725512E77AB4311B3193DF0220895A1F23BE1ED39B42
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess GetExitCodeProcess CreateProcessW GetTickCount GetModuleHandleW GetProcAddress lstrcmpW SetEnvironmentVariableW WriteFile CreateThread FreeLibrary LoadLibraryW lstrcpyW lstrcatW CopyFileW GetFileSize ReadFile HeapAlloc HeapFree GetProcessHeap MultiByteToWideChar GetACP GetModuleHandleA LoadLibraryA DuplicateHandle CreateEventW lstrcmpiA Sleep LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObject SetLastError GetLastError CloseHandle SetFileAttributesW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW ExpandEnvironmentStringsW lstrlenW lstrcpynW GetCommandLineW WaitForMultipleObjects lstrcmpiW LocalFree ProcessIdToSessionId GetCurrentProcessId

user32

SetTimer FillRect PostQuitMessage RegisterHotKey GetMessageW InvalidateRect TranslateMessage wsprintfW PostMessageW FindWindowW GetClassNameW LoadStringW SystemParametersInfoW DispatchMessageW PeekMessageW DefWindowProcW RegisterClassW CreateWindowExW DestroyWindow ShowWindow SetWindowPos GetSystemMetrics DrawTextW UpdateWindow GetDC ReleaseDC BeginPaint EndPaint

gdi32

DeleteDC CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject SelectObject SetBkMode CreateSolidBrush SetTextColor

advapi32

RegQueryValueExW RegCreateKeyExW GetUserNameW RegOpenKeyExW RegCloseKey RegFlushKey RegEnumValueW RegEnumKeyExW RegSetValueExW

shell32

SHFileOperationW CommandLineToArgvW

shlwapi

StrStrIW

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _seh_filter_exe _crt_atexit _register_thread_local_exe_atexit_callback _register_onexit_function _cexit abort _exit terminate _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _c_exit _set_app_type exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc free _set_new_mode

api-ms-win-crt-string-l1-1-0

wcsncmp

Sharing

General

Malware Config

Signatures

File Explorer

70875abaf964e9a2dddf1bd18fb3520a2e6dfbc655357b1b635594a9b004ebc6

kernel32

user32

gdi32

advapi32

shell32

shlwapi

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

generic