4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a

Sharing

Copy URL Twitter E-mail

General

Target
4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a
Size 1.5MB
Sample261108-dz7hvsxtcv
SHA256 4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a
MD5 d08feea441ad83e9f9cf25cd7648e0f6
SHA1 7b2eac7729c70e78e4a9ad072c3aa3ec5e0f34ed
SHA512 eb59974f21398fdddb484b56fd5b6e21dedc3f74bc15b26bcfa9ac1b3daafe1539d75e037ca5d450975f312095872562c98d6d41a4849668ba1471a50a82ed0f
SSDEEP 24576:Gn601XiGOnfkPdb8H/e9qybStJa0nyNy8H/e9qyz:Gn6mXwadbm/epSVycm/eB
TLSH
T12F75BF16F1F8D3E9F099D4358660A705D5FF78632F416E4BC2A4E216EF366B02F69220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a

File Explorer

4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a

.exe 1.5MB

4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a

IMPHASH e4b1eb290073dc852de024b9d40fec35
SHA256 4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a
MD5 d08feea441ad83e9f9cf25cd7648e0f6
SHA1 7b2eac7729c70e78e4a9ad072c3aa3ec5e0f34ed
SHA512 eb59974f21398fdddb484b56fd5b6e21dedc3f74bc15b26bcfa9ac1b3daafe1539d75e037ca5d450975f312095872562c98d6d41a4849668ba1471a50a82ed0f
SSDEEP 24576:Gn601XiGOnfkPdb8H/e9qybStJa0nyNy8H/e9qyz:Gn6mXwadbm/epSVycm/eB
TLSH
T12F75BF16F1F8D3E9F099D4358660A705D5FF78632F416E4BC2A4E216EF366B02F69220
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

215224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OpenProcess Sleep FormatMessageW GetLastError CloseHandle ExitProcess GetCurrentProcessId CreateProcessW CopyFileW QueryFullProcessImageNameW GetExitCodeProcess CreateDirectoryW WriteProcessMemory VirtualProtect GetModuleFileNameW GetFileAttributesW MultiByteToWideChar ResumeThread VirtualAllocEx GetModuleHandleW WideCharToMultiByte SetThreadContext SetEndOfFile WriteConsoleW HeapSize SetStdHandle CreateFileW WaitForSingleObject FindClose CreatePipe CreateJobObjectW TerminateProcess AssignProcessToJobObject DeviceIoControl WriteFile GetStdHandle FindNextFileW SetHandleInformation FindFirstFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP GetThreadContext SetInformationJobObject IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetStringTypeW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetProcAddress RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree GetLocaleInfoEx LCMapStringEx TryAcquireSRWLockExclusive QueryPerformanceCounter GetSystemTimeAsFileTime CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileAttributesExW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc RtlUnwind

user32

FindWindowW SendMessageW

advapi32

RegSetValueExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW StartServiceW RegOpenKeyExW OpenServiceW QueryServiceStatusEx RegQueryValueExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocString

iphlpapi

GetExtendedTcpTable

ws2_32

inet_ntoa ntohs

Name

.text

Size

413KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

632KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4249af3e97272e1facb33c9dd700adceaa518656946d9056ebb1277364b9363a

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

ws2_32

generic