e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349

Sharing

Copy URL Twitter E-mail

General

Target
e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349
Size 699KB
Sample261107-2dgx3sgd39
SHA256 e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349
MD5 3a609e2ab761bbed66ede2cdc0a08336
SHA1 33737137cd86568bc955b3ebaac64cca45eeddd1
SHA512 00ec484930dc3e13fefb94d98ba7b5bfc941de047a1e0ed85c467ac51b5c4f4099e28ee046141377a5ae879636a68f790bc207236d70e66c3c45f6097492155e
SSDEEP 12288:PrIlV+aWTqIOkU8AMXE9B7PElZlP41N+4PUWfo:PrITBsBOkUhMXcBwc04nA
TLSH
T1C0E48E31E6E07437D1E106B3EC17D2707D7DAE282B10846B9294AE1D69A94F2A7F7243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349

File Explorer

e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349

.exe 699KB

e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349

IMPHASH cedfb7d553896f2a8496df4ae9f55ba2
SHA256 e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349
MD5 3a609e2ab761bbed66ede2cdc0a08336
SHA1 33737137cd86568bc955b3ebaac64cca45eeddd1
SHA512 00ec484930dc3e13fefb94d98ba7b5bfc941de047a1e0ed85c467ac51b5c4f4099e28ee046141377a5ae879636a68f790bc207236d70e66c3c45f6097492155e
SSDEEP 12288:PrIlV+aWTqIOkU8AMXE9B7PElZlP41N+4PUWfo:PrITBsBOkUhMXcBwc04nA
TLSH
T1C0E48E31E6E07437D1E106B3EC17D2707D7DAE282B10846B9294AE1D69A94F2A7F7243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CloseHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc GetVersion GetCurrentThreadId GetThreadLocale GetStartupInfoA GetModuleFileNameA GetLocaleInfoA GetCommandLineA FreeLibrary ExitProcess WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleA WriteProcessMemory WriteFile WinExec VirtualFreeEx VirtualAllocEx TerminateProcess SuspendThread SizeofResource SetThreadContext SetLastError SetFileTime SetFilePointer SetFileAttributesA SetEndOfFile ResumeThread ReadFile OpenProcess OpenFileMappingA MapViewOfFile LockResource LoadResource LoadLibraryA IsBadReadPtr GlobalFree GlobalAlloc GetWindowsDirectoryA GetVersionExA GetThreadContext GetTempPathA GetTempFileNameA GetSystemDirectoryA GetShortPathNameA GetProcAddress GetModuleHandleA GetLocalTime GetFileTime GetFileSize GetDriveTypeA GetCurrentProcessId GetCurrentProcess GetComputerNameA GetACP FreeResource FreeLibrary FindResourceA FindNextFileA FindFirstFileA FindClose FileTimeToLocalFileTime FileTimeToDosDateTime ExitProcess DuplicateHandle DeleteFileA CreateThread CreateProcessA CreateFileMappingA CreateFileA CopyFileA CompareStringA CloseHandle CloseHandle CloseHandle LoadLibraryA GetProcAddress

kernelbase

WideCharToMultiByte MultiByteToWideChar Sleep

user32

GetKeyboardType MessageBoxA CharNextA CreateWindowExA UpdateWindow TranslateMessage SendMessageA RegisterClassA PostThreadMessageA PostMessageA PeekMessageA LoadCursorA GetWindowTextA GetMessageA FindWindowExA FindWindowA DispatchMessageA DefWindowProcA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegSetValueExA RegCreateKeyExA RegCloseKey FreeSid

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen

mpr

WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetCancelConnectionA WNetCancelConnection2A WNetAddConnection2A

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

wsock32

WSACleanup WSAStartup gethostname gethostbyname inet_ntoa

winmm

waveOutSetVolume waveOutGetVolume

Sharing

General

Malware Config

Signatures

File Explorer

e9efaea4e12c1f35cd61fc5e46aa30faaa68bc77d5b0ba780fc5161115a2b349

kernel32

kernelbase

user32

advapi32

oleaut32

mpr

version

wsock32

winmm

generic