2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f

Sharing

Copy URL Twitter E-mail

General

Target
2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f
Size 880KB
Sample261107-v5gm3afe29
SHA256 2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f
MD5 88591e673a441c083123664ebd2851ca
SHA1 027c702640117515fa9614e13167a9ebde555901
SHA512 db0baca2b06822acb7c4deafc833cdb9afef538dbc4906387ebae1fc771930ae523e5488f144ca0e91bac3dae0cd91bf98e239a5df392aea32c36b1905da2f67
SSDEEP 1536:se5zFxFmo7wbQ7m62vrUI+MFF31+LHgcMnU3g7kYfPuu0e:RlFmoOQaJUI+MXFMPIUgk8z
TLSH
T1811523039E9AE71DEDA326349CF7C94C2EBAA41F9C2D822E0158C4353EF2570755D61E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f

File Explorer

2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f

.exe 880KB

2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f

IMPHASH cebd5739a7474b99881fc250390195e9
SHA256 2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f
MD5 88591e673a441c083123664ebd2851ca
SHA1 027c702640117515fa9614e13167a9ebde555901
SHA512 db0baca2b06822acb7c4deafc833cdb9afef538dbc4906387ebae1fc771930ae523e5488f144ca0e91bac3dae0cd91bf98e239a5df392aea32c36b1905da2f67
SSDEEP 1536:se5zFxFmo7wbQ7m62vrUI+MFF31+LHgcMnU3g7kYfPuu0e:RlFmoOQaJUI+MXFMPIUgk8z
TLSH
T1811523039E9AE71DEDA326349CF7C94C2EBAA41F9C2D822E0158C4353EF2570755D61E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CloseEventLog DeregisterEventSource GetTokenInformation OpenEventLogW OpenProcessToken RegCloseKey RegCreateKeyExW RegEnumKeyExW RegFlushKey RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

kernel32

CloseHandle DeleteCriticalSection EnterCriticalSection FillConsoleOutputCharacterW FindResourceExW FlushFileBuffers FormatMessageW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetSystemWindowsDirectoryW GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource QueryPerformanceCounter RtlUnwind SetConsoleCursorPosition SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fmode _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsicmp _wcsnicmp abort calloc exit fprintf free fwrite iswctype malloc memmove signal strncmp vfprintf wcscspn wcslen wcstoul wprintf

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

816KB

Virtual Size

816KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2c006915e7e558f854390f91861686704ac7813cf9e38970899e56f28fdd972f

advapi32

kernel32

msvcrt

generic