2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e

Sharing

Copy URL Twitter E-mail

General

Target
2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e
Size 189KB
Sample261107-q1mlasfa85
SHA256 2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e
MD5 cddf6d2506fbf51e6461454d714e2988
SHA1 03951df028704cbf392c86b8c76b4769b71d76c9
SHA512 98e6ac417df541e12bf211f1e9c5e18ef40df5291eed5aeda6c0a3494bf278e56c9630ca832017b69f25fcb8f3f62d48166b4690668664516775ea0ae4d9b4d6
SSDEEP 1536:Ww5fBv1z8Fv88ugoK4B+Rwd/NHhxHx5vcMBC3Bjmd71TDLR1V:3Bv1z8roKMa8/NHhxHx50MBCxOZl
TLSH
T13C14B65127AD58F0E1768FF805FBDFA20B3D79434AE1875B4A14F6082CB29C06EE1366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e

File Explorer

2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e

.dll 189KB

2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e

IMPHASH 07b0f302de69ee18d96e27bb7e7c12b9
SHA256 2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e
MD5 cddf6d2506fbf51e6461454d714e2988
SHA1 03951df028704cbf392c86b8c76b4769b71d76c9
SHA512 98e6ac417df541e12bf211f1e9c5e18ef40df5291eed5aeda6c0a3494bf278e56c9630ca832017b69f25fcb8f3f62d48166b4690668664516775ea0ae4d9b4d6
SSDEEP 1536:Ww5fBv1z8Fv88ugoK4B+Rwd/NHhxHx5vcMBC3Bjmd71TDLR1V:3Bv1z8roKMa8/NHhxHx50MBCxOZl
TLSH
T13C14B65127AD58F0E1768FF805FBDFA20B3D79434AE1875B4A14F6082CB29C06EE1366
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CredEnumerateW CredFree CredWriteW

comctl32

InitCommonControls ord410 ord412 ord413

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar RaiseException SizeofResource lstrcmpW

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp free fwrite getenv memcmp memcpy memmove memset strchr strcmp strcspn strlen wcschr wcsrchr

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow

Name

.text

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

784B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

884B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2804a1bb2a92055f8a75ea2eda79dce0426d3532bc7f2417ab09b2965200296e

advapi32

comctl32

kernel32

ntdll

ucrtbase

user32

generic