ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc

Sharing

Copy URL Twitter E-mail

General

Target
ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc
Size 248KB
Sample261107-mhgesaa151
SHA256 ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc
MD5 d25e043dc959419cb6a62cebcc4c3537
SHA1 84881abc644075f362ef888bb5b5fe68221b2c52
SHA512 f901dcfadf06eb776bdcb1f8e23a52ffdc6c167b6545531420bd93e521e03ee0bd71dce354d34e42ec70f3b893f70f65df527837a39f10343720ba9f8bfdb15d
SSDEEP 1536:NdsCAyWn0n1+BxOzLZwKE/0el4RjFruVv8gQB5:NdsC4nWYBxOBBxelgruCd
TLSH
T14F44FF38A47A9284F0A163F70C70B1B78B9BFD65153524D67B849AC0FCF6BE631625E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc

File Explorer

ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc

.exe 248KB

ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc

IMPHASH d766ff9e857f9471b9ffb33040c84206
SHA256 ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc
MD5 d25e043dc959419cb6a62cebcc4c3537
SHA1 84881abc644075f362ef888bb5b5fe68221b2c52
SHA512 f901dcfadf06eb776bdcb1f8e23a52ffdc6c167b6545531420bd93e521e03ee0bd71dce354d34e42ec70f3b893f70f65df527837a39f10343720ba9f8bfdb15d
SSDEEP 1536:NdsCAyWn0n1+BxOzLZwKE/0el4RjFruVv8gQB5:NdsC4nWYBxOBBxelgruCd
TLSH
T14F44FF38A47A9284F0A163F70C70B1B78B9BFD65153524D67B849AC0FCF6BE631625E0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdi32

BitBlt CreateCompatibleDC CreateFontIndirectW CreatePen CreateSolidBrush DeleteDC DeleteObject GetObjectW GetStockObject LineTo MoveToEx PatBlt SelectObject SetBkMode SetTextColor

user32

AdjustWindowRect BeginPaint CallWindowProcW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EndPaint FindWindowW GetDlgCtrlID GetFocus GetForegroundWindow GetMessageW GetParent GetSysColor GetSystemMenu GetSystemMetrics GetWindowDC GetWindowLongPtrW GetWindowTextW InflateRect InvalidateRect IsDialogMessageW IsWindowEnabled LoadBitmapW LoadCursorW LoadIconW LoadStringW MessageBoxW OffsetRect PostQuitMessage RegisterClassExW ReleaseDC RemoveMenu SendMessageW SetFocus SetForegroundWindow SetWindowLongPtrW ShowWindow TranslateMessage UpdateWindow

shell32

ShellExecuteW

msvcrt

__C_specific_handler __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsicmp _wcsnicmp abort calloc exit free fwrite malloc memmove memset realloc signal strlen strncmp vfprintf wcschr wcslen wcsrchr wcstoul

kernel32

CloseHandle CreateMutexW DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetPrivateProfileIntW GetPrivateProfileSectionNamesW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetStartupInfoW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryW QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetCurrentDirectoryW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ee6452a3a0530d50cf8d8086ca30a3a2b56cffb3901aa7eb9162045238c7e8dc

gdi32

user32

shell32

msvcrt

kernel32

generic