4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553

Sharing

Copy URL Twitter E-mail

General

Target
4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553
Size 397KB
Sample261107-v3mfjadw2z
SHA256 4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553
MD5 9e04b41c0ebfc550a7955bac25a80862
SHA1 d806eb6b01e1593fa44f8583396e95cd6098c04f
SHA512 1c21d2ede9d76f620664384b891a5140e78f2a1e65a7c929de2040ed6d0397846489cf2921a9a062a857e86c22c9f8a3f8f72c08166034aeec68475813f6b89d
SSDEEP 6144:/xY1O9g1V6vmKTAKA7B2DSAHcFGfSQMO7Fh2+S46JMac1xLtz+GMVyW:pY1psmKTA68FGPMkFQ+SlJuxL9tcy
TLSH
T165849C11B581C076D5BF023108E6EB75567EB9704BB1C9CB73889F6D8D206C2AB31BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553

File Explorer

4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553

.dll 397KB

4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553

IMPHASH 3a78218efb06fd18272028d649b6b2f0
SHA256 4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553
MD5 9e04b41c0ebfc550a7955bac25a80862
SHA1 d806eb6b01e1593fa44f8583396e95cd6098c04f
SHA512 1c21d2ede9d76f620664384b891a5140e78f2a1e65a7c929de2040ed6d0397846489cf2921a9a062a857e86c22c9f8a3f8f72c08166034aeec68475813f6b89d
SSDEEP 6144:/xY1O9g1V6vmKTAKA7B2DSAHcFGfSQMO7Fh2+S46JMac1xLtz+GMVyW:pY1psmKTA68FGPMkFQ+SlJuxL9tcy
TLSH
T165849C11B581C076D5BF023108E6EB75567EB9704BB1C9CB73889F6D8D206C2AB31BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59815

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection GetLastError InitializeCriticalSectionEx SizeofResource LockResource LoadResource FindResourceW FindResourceExW DecodePointer GetProcAddress GetModuleHandleW FreeLibrary lstrcmpiW LoadLibraryExW CreateFileW WriteFile CloseHandle GetTempPathW GetTempFileNameW TerminateProcess GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW DeleteFileW GetCurrentThreadId GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle SetFilePointerEx RaiseException LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW LeaveCriticalSection EnterCriticalSection SetLastError WideCharToMultiByte MultiByteToWideChar GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetModuleFileNameW GetCommandLineW GetCommandLineA WriteConsoleW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType GetStdHandle GetModuleHandleExW GetStringTypeW FileTimeToSystemTime EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess

user32

GetClientRect GetWindowRect SendMessageW SetWindowTextW GetDlgItem MoveWindow GetSysColor MessageBoxTimeoutW GetWindowTextLengthW GetWindowTextW DefWindowProcW DestroyWindow GetActiveWindow IsDialogMessageW CharNextW DialogBoxParamW EnableWindow MessageBoxW SetWindowLongW CreateDialogParamW UnregisterClassW EndDialog SetFocus UpdateWindow ShowWindow

gdi32

SetTextColor CreateSolidBrush SetBkMode

advapi32

RegCreateKeyExW RegOpenKeyExW RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW

shell32

ShellExecuteW

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoInitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

Name

.text

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

207KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4026efd5ebe57b0c15c733c2c7913931ee5fd94e4585afcd81dba715eaa4d553

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic