292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2

Sharing

Copy URL Twitter E-mail

General

Target
292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2
Size 674KB
Sample261104-2dgmbady31
SHA256 292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2
MD5 765048229ff95ccc14e3eb6ca41f3ef2
SHA1 bd2551352e4d12ebb0e81fe44bbed30474a5548e
SHA512 6eef3856394f2dc6f4aac28f19120933f9d43c959aa8eb313ddbabee15217470ae762d63c8c4b768d7f017895c2984390d1982e8225a6350945cf7386e7ac6fa
SSDEEP 12288:Z/7qkNk9aR/RpeskbV7lGx+Kud1UJxtu5t2/HRtY0hh:pb+anpeBG+t/BsDvH
TLSH
T1ECE412514F940DBAF2E55FB0B5397B225AAA78204FF1ACE3836DDC8449227C1B1F950B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2

File Explorer

292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2

.exe 674KB

292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2

IMPHASH 55c035c08204dcace50b9039bb79058c
SHA256 292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2
MD5 765048229ff95ccc14e3eb6ca41f3ef2
SHA1 bd2551352e4d12ebb0e81fe44bbed30474a5548e
SHA512 6eef3856394f2dc6f4aac28f19120933f9d43c959aa8eb313ddbabee15217470ae762d63c8c4b768d7f017895c2984390d1982e8225a6350945cf7386e7ac6fa
SSDEEP 12288:Z/7qkNk9aR/RpeskbV7lGx+Kud1UJxtu5t2/HRtY0hh:pb+anpeBG+t/BsDvH
TLSH
T1ECE412514F940DBAF2E55FB0B5397B225AAA78204FF1ACE3836DDC8449227C1B1F950B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteW

ntdll

RtlDecompressBuffer

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen strncmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy wcsstr

user32

wsprintfW

kernel32

CloseHandle CreateDirectoryW CreateFileA CreateFileW CreateProcessW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW GetEnvironmentVariableA GetLastError GetModuleFileNameW GetStartupInfoA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadResource LockResource Module32FirstW Module32NextW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW SetFilePointer SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WriteFile lstrcatA lstrcatW lstrcpyA lstrcpynW lstrlenA

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

Name

.text

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

659KB

Virtual Size

658KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

292ddde2a6369eab57cc7e901cb4eecc0eab3de3ccb3c8cdae24ace64b9109f2

shell32

ntdll

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

user32

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic