00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc

Sharing

Copy URL Twitter E-mail

General

Target
00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc
Size 372KB
Sample261107-v5gm3afe28
SHA256 00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc
MD5 ee65b3dabf770e460adfc01078a63e41
SHA1 975f24406ecd6e69c276db619113abb53fec5647
SHA512 08c74ffe4f069aaf4c677b614189380cfa24666aea5421b7c5ec7311f3b15b31340c15d2ea6ad6f51e0b9f0b329deed7b5aec36e08c1dd631458251eb107e567
SSDEEP 6144:XyRZ39DBhErD/rCb7Y+mKgwab0hDGqE0skwvAC4UhzGKfC8v1C96Z1mu1U:XyRZ39DBhMD/rCb7Y+mKgwab0hDGqE0c
TLSH
T1DA84EA41A7E9979BF5F12A3048B687A90536FC51BC31C90FAB48760E1973B00D7A772B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc

File Explorer

00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc

.exe 372KB

00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc

IMPHASH 9c858100a6d8d7c8c129c629bb62a08f
SHA256 00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc
MD5 ee65b3dabf770e460adfc01078a63e41
SHA1 975f24406ecd6e69c276db619113abb53fec5647
SHA512 08c74ffe4f069aaf4c677b614189380cfa24666aea5421b7c5ec7311f3b15b31340c15d2ea6ad6f51e0b9f0b329deed7b5aec36e08c1dd631458251eb107e567
SSDEEP 6144:XyRZ39DBhErD/rCb7Y+mKgwab0hDGqE0skwvAC4UhzGKfC8v1C96Z1mu1U:XyRZ39DBhMD/rCb7Y+mKgwab0hDGqE0c
TLSH
T1DA84EA41A7E9979BF5F12A3048B687A90536FC51BC31C90FAB48760E1973B00D7A772B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51549

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlAssert RtlUnicodeStringToInteger

advapi32

BackupEventLogW ClearEventLogW CloseEventLog ConvertSidToStringSidW EqualSid GetNumberOfEventLogRecords IsValidSid LookupAccountSidW OpenBackupEventLogW OpenEventLogW ReadEventLogW RegCloseKey RegConnectRegistryW RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx PropertySheetW

comdlg32

GetOpenFileNameW GetSaveFileNameW

kernel32

CloseHandle CreateEventW CreateThread DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FormatMessageW FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetFileAttributesExW GetLastError GetLocaleInfoW GetModuleHandleA GetNumberFormatW GetProcAddress GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MulDiv QueryPerformanceCounter ResumeThread RtlUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsicmp _wtol abort calloc exit fprintf free fwrite iswctype malloc memmove signal strncmp swprintf swscanf towupper vfprintf wcschr wcscpy wcslen wcsncpy wcsstr wcstok

shell32

CommandLineToArgvW ShellAboutW ShellExecuteW

shlwapi

StrFormatByteSizeW

gdi32

CreateFontIndirectW DeleteObject GetDeviceCaps

user32

BeginDeferWindowPos CheckMenuItem CheckMenuRadioItem CheckRadioButton CloseClipboard CreateDialogParamW CreateWindowExW DefWindowProcW DeferWindowPos DestroyWindow DialogBoxParamW DispatchMessageW EmptyClipboard EnableMenuItem EnableWindow EndDeferWindowPos EndDialog GetCapture GetClientRect GetCursorPos GetDC GetDlgItem GetDlgItemInt GetDlgItemTextW GetFocus GetMenu GetMessageW GetParent GetScrollInfo GetSysColor GetSystemMetrics GetWindowLongW GetWindowPlacement GetWindowRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowVisible LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxW MoveWindow OpenClipboard PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient ScrollWindowEx SendDlgItemMessageW SendMessageW SetCapture SetClipboardData SetCursor SetDlgItemInt SetDlgItemTextW SetFocus SetScrollInfo SetWindowLongW SetWindowPos SetWindowTextW ShowScrollBar ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

00790aa054275331b63b5fa799dedce0926ffe15b238f53bfade9027c5f91dbc

ntdll

advapi32

comctl32

comdlg32

kernel32

msvcrt

shell32

shlwapi

gdi32

user32

generic