4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e

Sharing

Copy URL Twitter E-mail

General

Target
4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e
Size 1.7MB
Sample261108-e3hvcaxway
SHA256 4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e
MD5 8a03f554f74e136bf50df1c2372674e8
SHA1 57f47f794e222a5f9ceb69aa102f7aab7368d98e
SHA512 c47f59e9726cddcc82ab0058a90b55edbc819ff5b44af2f3d4efed9aef5bc6d72184308db66408ec53ed8880b4e4ba920187c432568868241346d3aeb19b34f4
SSDEEP 24576:/LPMZeO0fWRYfUuyn8/8pUEqnF7pmK/yjbqStJa0://Om5pm8/8pUEqnF7pmK/rS
TLSH
T1E1854C1378BE93CEE604E3360783E141E4EF9DE55F919FC9A0CAC1E5D4693621E942A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e

File Explorer

4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e

.exe 1.7MB

4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e

IMPHASH a48adcc23dcc7ffed4adec783f0762c5
SHA256 4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e
MD5 8a03f554f74e136bf50df1c2372674e8
SHA1 57f47f794e222a5f9ceb69aa102f7aab7368d98e
SHA512 c47f59e9726cddcc82ab0058a90b55edbc819ff5b44af2f3d4efed9aef5bc6d72184308db66408ec53ed8880b4e4ba920187c432568868241346d3aeb19b34f4
SSDEEP 24576:/LPMZeO0fWRYfUuyn8/8pUEqnF7pmK/yjbqStJa0://Om5pm8/8pUEqnF7pmK/rS
TLSH
T1E1854C1378BE93CEE604E3360783E141E4EF9DE55F919FC9A0CAC1E5D4693621E942A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

254224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

FindWindowW SendMessageW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

SysAllocString SysFreeString

iphlpapi

GetExtendedTcpTable

ws2_32

inet_ntoa ntohs

advapi32

StartServiceW CreateServiceW RegCloseKey QueryServiceStatus CloseServiceHandle OpenSCManagerW RegSetValueExW QueryServiceStatusEx RegOpenKeyExW OpenServiceW RegQueryValueExW

shell32

SHGetFolderPathW

kernel32

GetACP GetOEMCP GetTimeZoneInformation IsValidCodePage HeapReAlloc FindFirstFileExW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile DecodePointer ReadConsoleW ReadFile CreateDirectoryW SetInformationJobObject FindFirstFileW WriteProcessMemory SetHandleInformation VirtualProtect FindNextFileW GetStdHandle WriteFile DeviceIoControl AssignProcessToJobObject TerminateProcess GetModuleFileNameW CreateJobObjectW CreatePipe FindClose WaitForSingleObject CreateFileW GetFileAttributesW ResumeThread OpenProcess MultiByteToWideChar Sleep FormatMessageW GetLastError CloseHandle GetThreadContext VirtualAllocEx ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte QueryFullProcessImageNameW SetThreadContext GetExitCodeProcess GetStringTypeW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RtlUnwind LocalFree GetLocaleInfoEx LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter CompareStringEx GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetFileAttributesExW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess GetProcAddress RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

453KB

Virtual Size

452KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

892KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

338KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4393997d6104118b7f436671b5649458c38dd9839f1a0a42e85173ec57c8525e

user32

ole32

oleaut32

iphlpapi

ws2_32

advapi32

shell32

kernel32

generic