8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991

Sharing

Copy URL Twitter E-mail

General

Target
8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991
Size 389KB
Sample261102-x762vaez3l
SHA256 8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991
MD5 d7ae17257bd86bf59c2fc296161e8ced
SHA1 fb2d9a8a3aa8698ced6440aa1e0418c94368623d
SHA512 d1b24022dad44caa2b9ea8c312f2dbf6fdbe3aa2506f4b5afd240947235f55d3fe6c2c40020022e05ba73327f5d5c7a65514db0c758ac72799348390fe19b48a
SSDEEP 6144:23TVNcggipTx3IFhPVdsRYEud9uPEbWO4QwbYgdW:23TVNcggipdInnsRYjkP4PgdW
TLSH
T1EA84D640E7E901E9F6F7ABB898B505109E32BC9A9F75C69E1344445E4E33A80DD78B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991

File Explorer

8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991

.exe 389KB

8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991

IMPHASH 960218a572e5beef77cf1cc1257d0a2e
SHA256 8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991
MD5 d7ae17257bd86bf59c2fc296161e8ced
SHA1 fb2d9a8a3aa8698ced6440aa1e0418c94368623d
SHA512 d1b24022dad44caa2b9ea8c312f2dbf6fdbe3aa2506f4b5afd240947235f55d3fe6c2c40020022e05ba73327f5d5c7a65514db0c758ac72799348390fe19b48a
SSDEEP 6144:23TVNcggipTx3IFhPVdsRYEud9uPEbWO4QwbYgdW:23TVNcggipdInnsRYjkP4PgdW
TLSH
T1EA84D640E7E901E9F6F7ABB898B505109E32BC9A9F75C69E1344445E4E33A80DD78B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Dev\tools\shittim-logon\installer\obj\uninstall.pdb

user32

GetWindow EnumWindows IsWindowVisible GetWindowThreadProcessId PostMessageW

advapi32

RegCloseKey RegGetValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW OpenProcessToken AdjustTokenPrivileges GetTokenInformation LookupPrivilegeValueW RegDeleteKeyW RegCreateKeyExW RegDeleteKeyExW

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysAllocString VariantInit SysFreeString

kernel32

HeapReAlloc FlushFileBuffers GetConsoleOutputCP CreateFileW GetStartupInfoW HeapSize SetFilePointerEx ReadConsoleW ReadFile GetStringTypeW SetStdHandle GetProcessHeap GetStdHandle GetCommandLineW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetLastError SetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetModuleHandleW GetProcAddress LocalFree QueryFullProcessImageNameW MoveFileExW WideCharToMultiByte LCIDToLocaleName GetUserDefaultUILanguage GetConsoleMode WriteConsoleW SetConsoleOutputCP GetCurrentConsoleFontEx SetCurrentConsoleFontEx GetConsoleProcessList CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LCMapStringW CompareStringW LoadLibraryExW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetCommandLineA IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileType HeapFree HeapAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect

Name

.text

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8191097380a9d1bfd680ed39a8abbd2eb83e38024e2a5200fc9b0657faa76991

user32

advapi32

shell32

ole32

oleaut32

kernel32

generic