6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a

Sharing

Copy URL Twitter E-mail

General

Target
6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a
Size 2.6MB
Sample261107-pm6ataeh64
SHA256 6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a
MD5 f5b748d585ef69f0a16d5b2837acb91e
SHA1 118dcc589d18312254398d900074453403decd26
SHA512 669b9bf5983e44ffb01ca67ec571919f2dfa722e26c0617474a6c2d2fb05593e46b49334c651dbbb1c1abe60fdbba06416b169ef3e9dad95b86ff8643c032328
SSDEEP 49152:sGjDMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvjv2KnCSt:j+sSuJj+KnCS
TLSH
T147D57C07B25548EAD599C038CE469235EB31BC5807F6A5EB32905BD52E27BE43F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a

File Explorer

6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a

.exe 2.6MB

6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a

IMPHASH 0d379df5a638377aecbcb544843b6b31
SHA256 6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a
MD5 f5b748d585ef69f0a16d5b2837acb91e
SHA1 118dcc589d18312254398d900074453403decd26
SHA512 669b9bf5983e44ffb01ca67ec571919f2dfa722e26c0617474a6c2d2fb05593e46b49334c651dbbb1c1abe60fdbba06416b169ef3e9dad95b86ff8643c032328
SSDEEP 49152:sGjDMKeLJ95d90stngnOIoYcGfXZRcu+CsT1mTvjv2KnCSt:j+sSuJj+KnCS
TLSH
T147D57C07B25548EAD599C038CE469235EB31BC5807F6A5EB32905BD52E27BE43F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

AdjustWindowRect CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetSysColor GetSysColorBrush GetSystemMetrics IsDialogMessageW LoadCursorW LoadIconW LoadImageW MessageBoxW PostMessageW PostQuitMessage RegisterClassExW SetWindowTextW ShowWindow TranslateMessage UpdateWindow

gdi32

SetBkColor

shell32

ShellExecuteW

comctl32

InitCommonControlsEx

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CreateFileW CreateIoCompletionPort CreateJobObjectW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW FlsAlloc FlsGetValue FlsSetValue GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetQueuedCompletionStatus GetStartupInfoW GetSystemTimeAsFileTime GetThreadContext GetThreadId InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadResource LockResource MultiByteToWideChar QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseSRWLockExclusive ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetFileAttributesW SetInformationJobObject SetThreadContext SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualAllocEx VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory __C_specific_handler

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv __p__wcmdln _assert _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _errno _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswprintf_s fflush fputc fputs fwrite

api-ms-win-crt-string-l1-1-0

iswctype isxdigit memset strcmp strlen strncmp wcslen

api-ms-win-crt-convert-l1-1-0

strtod strtof strtol strtoll strtoul strtoull wcstod wcstol wcstoul

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

Name

.text

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/30

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/42

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/53

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6bc2a4bf0492133c183863c56a68e2c0c01f77202b318d9e2600f7e125ab348a

user32

gdi32

shell32

comctl32

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic