8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d

Sharing

Copy URL Twitter E-mail

General

Target
8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d
Size 125KB
Sample261107-v3nzcsfd98
SHA256 8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d
MD5 8cbb0aed219fa6bf4443629e652e7f46
SHA1 1f8b160948dce4b8a57f8eeedf36dc0c0700cfa2
SHA512 878753d48888700fb9611269574603c31a08ae2c4b1dfd25445f36a75526ef667f6808f330224fae26315e2d65770444feb78b3d26360d41bbb384cae89d901e
SSDEEP 3072:GyunbsAPKivgDh/vVI2ey7USxcG8Ojo+:G7rEDh/viWDj
TLSH
T19CC3D504EFDAE916FAB1167849F7C6BD037AFC10BA11CA4B93C86C5B7A2071185E17D2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d

File Explorer

8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d

.exe 125KB

8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d

IMPHASH 386cef897ed6db0cb4bf0a0571243884
SHA256 8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d
MD5 8cbb0aed219fa6bf4443629e652e7f46
SHA1 1f8b160948dce4b8a57f8eeedf36dc0c0700cfa2
SHA512 878753d48888700fb9611269574603c31a08ae2c4b1dfd25445f36a75526ef667f6808f330224fae26315e2d65770444feb78b3d26360d41bbb384cae89d901e
SSDEEP 3072:GyunbsAPKivgDh/vVI2ey7USxcG8Ojo+:G7rEDh/viWDj
TLSH
T19CC3D504EFDAE916FAB1167849F7C6BD037AFC10BA11CA4B93C86C5B7A2071185E17D2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19325

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

comdlg32

GetOpenFileNameW

kernel32

DeleteCriticalSection EnterCriticalSection FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetModuleHandleA GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetTickCount GetUserDefaultUILanguage InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree QueryPerformanceCounter SearchPathW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wargv __wgetmainargs __winitenv _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln abort calloc exit fprintf free fwrite malloc memmove signal strncmp vfprintf wcscmp wcsrchr

shell32

DragAcceptFiles DragFinish DragQueryFileW ShellAboutW ShellExecuteW

winmm

mciGetErrorStringW mciSendCommandW

gdi32

DeleteObject

user32

CharLowerBuffW CheckMenuItem CreateWindowExW DefWindowProcW DestroyAcceleratorTable DispatchMessageW EnableMenuItem GetClientRect GetMenu GetMenuItemInfoW GetMessageW GetSubMenu GetSystemMetrics GetWindowRect InsertMenuItemW KillTimer LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxW MoveWindow PostMessageW PostQuitMessage RegisterClassExW SendMessageW SetParent SetProcessDefaultLayout SetTimer SetWindowTextW ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow

Name

.text

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

28B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8857ef8bef366c5d921e23e38fb17fbda175d19148fa1a4a8900196e5aeed10d

advapi32

comctl32

comdlg32

kernel32

msvcrt

shell32

winmm

gdi32

user32

generic