dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098

Sharing

Copy URL Twitter E-mail

General

Target
dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098
Size 1.7MB
Sample261108-e3hvcat12r
SHA256 dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098
MD5 947dbdeb398876aa19c370b9d797f8b8
SHA1 8ba88581da9800e08b8a76225ecf7bb4feaef7b5
SHA512 8362809d68a7e0f8eba3dd95256a330045c55a2faa23081f8e6dc534cc59144c459f5ecee1bcf5c0e0a44d73bc580efb2ef35a03c486b04ad5caf0251acbfd12
SSDEEP 24576:TLPMZeO0fWRYfUuyn8/8pUEqnF7pmK/yjbqStJa0Q:T/Om5pm8/8pUEqnF7pmK/rSC
TLSH
T1EB855C1378BE93CEE604E3360783E141E4EF9DE55F919FC9A0CAC1E5D4693621E942A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098

File Explorer

dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098

.exe 1.7MB

dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098

IMPHASH a48adcc23dcc7ffed4adec783f0762c5
SHA256 dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098
MD5 947dbdeb398876aa19c370b9d797f8b8
SHA1 8ba88581da9800e08b8a76225ecf7bb4feaef7b5
SHA512 8362809d68a7e0f8eba3dd95256a330045c55a2faa23081f8e6dc534cc59144c459f5ecee1bcf5c0e0a44d73bc580efb2ef35a03c486b04ad5caf0251acbfd12
SSDEEP 24576:TLPMZeO0fWRYfUuyn8/8pUEqnF7pmK/yjbqStJa0Q:T/Om5pm8/8pUEqnF7pmK/rSC
TLSH
T1EB855C1378BE93CEE604E3360783E141E4EF9DE55F919FC9A0CAC1E5D4693621E942A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c7:6c:57:93:98:85:c9:3d:77:6f:fe:65:0f:b4:f2:86:c9:99:e8:8a:bb:4c:47:02:b9:8e:5f:3b:d9:bc:0e:eb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

254224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

FindWindowW SendMessageW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

SysAllocString SysFreeString

iphlpapi

GetExtendedTcpTable

ws2_32

inet_ntoa ntohs

advapi32

StartServiceW CreateServiceW RegCloseKey QueryServiceStatus CloseServiceHandle OpenSCManagerW RegSetValueExW QueryServiceStatusEx RegOpenKeyExW OpenServiceW RegQueryValueExW

shell32

SHGetFolderPathW

kernel32

GetACP GetOEMCP GetTimeZoneInformation IsValidCodePage HeapReAlloc FindFirstFileExW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile DecodePointer ReadConsoleW ReadFile CreateDirectoryW SetInformationJobObject FindFirstFileW WriteProcessMemory SetHandleInformation VirtualProtect FindNextFileW GetStdHandle WriteFile DeviceIoControl AssignProcessToJobObject TerminateProcess GetModuleFileNameW CreateJobObjectW CreatePipe FindClose WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread OpenProcess MultiByteToWideChar Sleep FormatMessageW GetLastError CloseHandle GetThreadContext VirtualAllocEx ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte QueryFullProcessImageNameW SetThreadContext GetExitCodeProcess GetStringTypeW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RtlUnwind LocalFree GetLocaleInfoEx LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter CompareStringEx GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetFileAttributesExW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess GetProcAddress RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

453KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

892KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

338KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dab19b8c19a963b46a1e1835fcbeca2d89250a90e018f2dc6c481e24efbda098

PE Signature issue

user32

ole32

oleaut32

iphlpapi

ws2_32

advapi32

shell32

kernel32

generic