40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

Sharing

Copy URL Twitter E-mail

General

Target
40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
Size 497KB
Sample261107-rt2bjsyyhs
SHA256 40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
MD5 8f66b94e8d3855e10e9d9b32ea1f54eb
SHA1 2b71c58baee241244a79eba9b9e19ad47e821537
SHA512 2e012def7d18c5dc4e78827d337568607bd290698f2f1996d4650344d742909084c07a5fa15ff057b21b6ea37adb066ebb96fdd6747b9eb2a9119b5d2b4ff351
SSDEEP 3072:4oAc8Ad/ITi7XJ1gqNrflj1cDual/+RiY6p0sTAzmBwNUdWGX+ceu+F+ScADcAsi:4oAcnd/ITczFNj1cnN+WcsBWWex0
TLSH
T112B420465E0BC8DDEBE2947460FAC4F492317D8C49E5908E2CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

File Explorer

40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

.exe 497KB

40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

IMPHASH 49be563b8887198da2bb73c8aa675677
SHA256 40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa
MD5 8f66b94e8d3855e10e9d9b32ea1f54eb
SHA1 2b71c58baee241244a79eba9b9e19ad47e821537
SHA512 2e012def7d18c5dc4e78827d337568607bd290698f2f1996d4650344d742909084c07a5fa15ff057b21b6ea37adb066ebb96fdd6747b9eb2a9119b5d2b4ff351
SSDEEP 3072:4oAc8Ad/ITi7XJ1gqNrflj1cDual/+RiY6p0sTAzmBwNUdWGX+ceu+F+ScADcAsi:4oAcnd/ITczFNj1cnN+WcsBWWex0
TLSH
T112B420465E0BC8DDEBE2947460FAC4F492317D8C49E5908E2CD7B7E8A17C06E2167D2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateMutexW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW GetCurrentProcessId GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileSizeEx GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemInfo GetSystemTimeAsFileTime GetSystemTimes GetTempPathW GetTickCount GetTickCount64 GetVolumeInformationW GetWindowsDirectoryW InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW ReadFile SetEnvironmentVariableA SetFilePointerEx SetThreadExecutionState SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte lstrcmpiW lstrcpyW

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _errno _fmode _initterm _ismbblead _lock _snprintf _snwprintf _stricmp _strtoui64 _unlock _wcsicmp _wfopen abort atexit atof atoi calloc exit fclose fgets fprintf fputc fread free fwrite getc isdigit isspace isxdigit localeconv malloc memcpy memmove memset realloc signal strcat strchr strcmp strerror strlen strncat strncmp strncpy strpbrk strrchr strstr strtol strtoul tolower toupper ungetc vfprintf wcscpy wcslen wcsncpy wcsrchr _strtoui64 _strtoi64

shell32

SHCreateDirectoryExW SHFileOperationW SHGetFolderPathW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

366KB

Virtual Size

365KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

40e417c19f5313518cbb89355e5d7c597a4e9c2bd0dadce95a37b7dc638015fa

advapi32

kernel32

msvcrt

shell32

winhttp

generic