68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5

Sharing

Copy URL Twitter E-mail

General

Target
68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5
Size 183KB
Sample261104-1a5pasfz3j
SHA256 68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5
MD5 aa52e2e2be3987da6185a5f4bb0708c6
SHA1 cfc15237d498e7841646be147b74b0d5ef52308e
SHA512 00e8c462233b1e36294d8f47c74f4695b6de2264ee46ecc80b6907850b243bd8a04d33c6db321ddfcad5c17166e5dfc9a9e3a6fa5ac256b8273a2069bb9bbf4b
SSDEEP 3072:9CdMUmJP1rq6F7lEiOy4UDcn2YIfnoM88n5QPIWqbjE99:9CpmJPQ6HE1n0YhIfno58n50IWojE99
TLSH
T1FD047D12B181E1BBC64700B125DD93B8A573C6344B1298D75BE49EB89EAFBF10534B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5

File Explorer

68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5

.exe 183KB

68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5

IMPHASH a16fc705161f8181ed64e2d7103a2796
SHA256 68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5
MD5 aa52e2e2be3987da6185a5f4bb0708c6
SHA1 cfc15237d498e7841646be147b74b0d5ef52308e
SHA512 00e8c462233b1e36294d8f47c74f4695b6de2264ee46ecc80b6907850b243bd8a04d33c6db321ddfcad5c17166e5dfc9a9e3a6fa5ac256b8273a2069bb9bbf4b
SSDEEP 3072:9CdMUmJP1rq6F7lEiOy4UDcn2YIfnoM88n5QPIWqbjE99:9CpmJPQ6HE1n0YhIfno58n50IWojE99
TLSH
T1FD047D12B181E1BBC64700B125DD93B8A573C6344B1298D75BE49EB89EAFBF10534B2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

145984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

CompareStringOrdinal SetUnhandledExceptionFilter InitializeSListHead SetEnvironmentVariableW GetLastError GetProcessHeap HeapFree CloseHandle CreateFileW ReadFile SetFilePointer WaitForSingleObject TerminateProcess GetExitCodeProcess SetLastError GetFinalPathNameByHandleW CreateProcessW VirtualAllocEx WriteProcessMemory GetModuleHandleW GetProcAddress VirtualFreeEx CreateRemoteThread GetExitCodeThread ResumeThread AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread HeapReAlloc GetCurrentThreadId GetCurrentDirectoryW GetCurrentProcess RtlCaptureContext ReleaseMutex WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree IsThreadAFiber FlsSetValue HeapAlloc GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx GetModuleHandleA GetFullPathNameW FindFirstFileExW FindClose SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess IsProcessorFeaturePresent GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread GetSystemTimeAsFileTime QueryPerformanceCounter

ntdll

NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

vcruntime140

__current_exception_context __current_exception _except_handler4_common memmove memcpy memcmp __CxxFrameHandler3 memset

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _initterm_e exit _exit _get_initial_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _configure_narrow_argv _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _controlfp_s terminate _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

68de266af13a201d26de38a14e247dd45df50e8fdbc9f8a0782c52bf85a472b5

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic