1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db

Sharing

Copy URL Twitter E-mail

General

Target
1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db
Size 2.2MB
Sample261102-sv7emaa141
SHA256 1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db
MD5 bd1144bed9fc61b075870dadd3e6db6b
SHA1 d8399945517a4ee7676a7d144e526551634ead94
SHA512 cb9e179f7964ac7a14f7b2a3f8d6ec28c0c3ed0e23ad3999d7940e6b436fe7e17122b2b2cc469f1352aa11e5f7e648700fffd7a7bebd845a499883e8eeefeef8
SSDEEP 49152:YC9LJ05i/rejxZb4MGvoadf5CyFpZr6XK:YN7LGgaxCYZ
TLSH
T124B5AE83B7E690CAE31080B058A67F3AE523F84C5B500ABB65F4507E3D67E963CF2655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db

File Explorer

1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db

.exe 2.2MB

1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db

IMPHASH 802fbb91faca2f5b20c7d126a845f2f0
SHA256 1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db
MD5 bd1144bed9fc61b075870dadd3e6db6b
SHA1 d8399945517a4ee7676a7d144e526551634ead94
SHA512 cb9e179f7964ac7a14f7b2a3f8d6ec28c0c3ed0e23ad3999d7940e6b436fe7e17122b2b2cc469f1352aa11e5f7e648700fffd7a7bebd845a499883e8eeefeef8
SSDEEP 49152:YC9LJ05i/rejxZb4MGvoadf5CyFpZr6XK:YN7LGgaxCYZ
TLSH
T124B5AE83B7E690CAE31080B058A67F3AE523F84C5B500ABB65F4507E3D67E963CF2655
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1910352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileExW CreateDirectoryW CreateFileW CreateMutexA CreateProcessW DeleteCriticalSection ExitProcess FindClose FindFirstFileExW FindResourceW FormatMessageW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryA LoadLibraryExA LoadLibraryExW LoadResource LockResource MultiByteToWideChar QueryPerformanceCounter ReleaseMutex RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SizeofResource TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW ExitProcess CreateFileW DeleteCriticalSection HeapFree GetModuleFileNameW RtlPcToFileHeader GetPrivateProfileStringW MultiByteToWideChar CreateProcessW GetProcessHeap EncodePointer FindFirstFileW TlsAlloc FindNextFileW RtlVirtualUnwind LCMapStringW Sleep GetModuleHandleExW OpenProcess FlushFileBuffers RtlLookupFunctionEntry GetOEMCP GetEnvironmentStringsW RaiseException HeapSize WritePrivateProfileStringW GetCommandLineA GetSystemTimeAsFileTime SetLastError GetStdHandle GetFileType GetStringTypeW SetEnvironmentVariableW RtlUnwindEx TlsSetValue GetEnvironmentVariableW GetCPInfo FreeLibrary EnterCriticalSection InitializeCriticalSectionAndSpinCount GetCommandLineW GetConsoleMode OutputDebugStringW GetCurrentProcess TlsGetValue WideCharToMultiByte RtlCaptureContext FindFirstFileExW UnhandledExceptionFilter FreeEnvironmentStringsW TlsFree LeaveCriticalSection InitializeSListHead GetPrivateProfileIntW TerminateProcess CloseHandle SetUnhandledExceptionFilter GetCurrentThreadId GetProcAddress GetACP IsDebuggerPresent IsValidCodePage GetConsoleCP CompareStringW WriteFile GetLastError FindClose HeapAlloc LoadLibraryA GetModuleHandleW LoadLibraryExW SetStdHandle GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId SetFilePointerEx WriteConsoleW HeapReAlloc lstrlenW

ole32

CoCreateInstance CoInitializeEx

oleaut32

GetErrorInfo SysAllocStringLen SysFreeString SysStringLen VariantClear

ntdll

NtWriteFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

user32

EnumDisplayMonitors GetMonitorInfoW

gdi32

CreateDCW GetDeviceCaps DeleteDC

shell32

ShellExecuteW

shlwapi

PathFileExistsW StrStrIW PathRemoveFileSpecW

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free

api-ms-win-crt-string-l1-1-0

wcsncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

279KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

26B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1189738bf40cb1224778031f52972a40377aad779618758c908867b0b68b28db

kernel32

ole32

oleaut32

ntdll

api-ms-win-core-synch-l1-2-0

winhttp

user32

gdi32

shell32

shlwapi

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic