35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26

Sharing

Copy URL Twitter E-mail

General

Target
35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26
Size 1.2MB
Sample261108-e5dcmsxwbw
SHA256 35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26
MD5 75da66eb0823b0bb1f894c9cba618ab1
SHA1 f0f6b0c33366817ac4596d1c225a46ecc90dff84
SHA512 197c6075fa9f26c5b993f9422cd974335b3fe05e28dbcf6d9ba13b719c0dcc4b58a7d1950e3535abf371f289ef8dc35619e79dc7008b649c5d1a006089fb4e41
SSDEEP 12288:PVpI5ZC9L61HBlXc8Z9M18+Xe6hcER5dm8Fik8w+JP/e9qy//bS4+JxBUqkMKUqa:45hlJG1feEMU8H/e9qybStJa0MK
TLSH
T179459D16F1F8C3E9F19ED4358650A605D1FF78632F016E4BC2A4E256EF366B02F69220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26

File Explorer

35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26

.exe 1.2MB

35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26

IMPHASH cdeea21e754e0169bbe3ec71f31912c7
SHA256 35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26
MD5 75da66eb0823b0bb1f894c9cba618ab1
SHA1 f0f6b0c33366817ac4596d1c225a46ecc90dff84
SHA512 197c6075fa9f26c5b993f9422cd974335b3fe05e28dbcf6d9ba13b719c0dcc4b58a7d1950e3535abf371f289ef8dc35619e79dc7008b649c5d1a006089fb4e41
SSDEEP 12288:PVpI5ZC9L61HBlXc8Z9M18+Xe6hcER5dm8Fik8w+JP/e9qy//bS4+JxBUqkMKUqa:45hlJG1feEMU8H/e9qybStJa0MK
TLSH
T179459D16F1F8C3E9F19ED4358650A605D1FF78632F016E4BC2A4E256EF366B02F69220
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

FindWindowW SendMessageW

ole32

CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

SysAllocString SysFreeString

iphlpapi

GetExtendedTcpTable

ws2_32

inet_ntoa ntohs

advapi32

OpenServiceW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW StartServiceW RegSetValueExW QueryServiceStatusEx RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW

kernel32

FindFirstFileExW IsValidCodePage GetTimeZoneInformation HeapReAlloc GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile GetLocaleInfoEx ReadConsoleW ReadFile SetInformationJobObject FindFirstFileW SetHandleInformation FindNextFileW GetStdHandle WriteFile DeviceIoControl AssignProcessToJobObject TerminateProcess CreateJobObjectW CreatePipe FindClose WaitForSingleObject CreateFileW ResumeThread OpenProcess Sleep FormatMessageW GetLastError CloseHandle ExitProcess GetCurrentProcessId CreateProcessW CopyFileW QueryFullProcessImageNameW GetExitCodeProcess CreateDirectoryW WriteProcessMemory VirtualProtect GetModuleFileNameW GetFileAttributesW MultiByteToWideChar GetThreadContext VirtualAllocEx GetModuleHandleW WideCharToMultiByte SetThreadContext GetStringTypeW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetProcAddress RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree RtlUnwind LCMapStringEx TryAcquireSRWLockExclusive QueryPerformanceCounter GetSystemTimeAsFileTime CompareStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess GetConsoleMode RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileAttributesExW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP

Name

.text

Size

411KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

632KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

35fa880749410630c93184ce4055c71ca2f0569caa450769addc66006efb7c26

user32

ole32

oleaut32

iphlpapi

ws2_32

advapi32

shell32

kernel32

generic