ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068

General

Target
ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068
Size 961KB
Sample261110-hxtlfahs7t
SHA256 ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068
MD5 6af10ad0d687b5661e26b4028542ebaf
SHA1 4ff9709e6c18dda4b71d412010a320d486387c9f
SHA512 aad9fe313b77f47057ed953366ffb174058f144392a4504c83c5b03428c23c4f5c64dc59b6b0f4cb8644518a13fa1f86952d35c2f11c44051b3c196f49ce1727
SSDEEP 12288:sHCg7t231kNu3JbxUUDuVFkzZry9+clw8NQBXkomWu:sig7t4kWUKuVmUaz
TLSH
T17625928167F90258F6FBBF706EB555614A7ABC9AAF34C28E1240451E0E72F91C970B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068

File Explorer

ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068

.exe 961KB

ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068

IMPHASH d541dd6cb1324aa286b7b68a763af89e
SHA256 ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068
MD5 6af10ad0d687b5661e26b4028542ebaf
SHA1 4ff9709e6c18dda4b71d412010a320d486387c9f
SHA512 aad9fe313b77f47057ed953366ffb174058f144392a4504c83c5b03428c23c4f5c64dc59b6b0f4cb8644518a13fa1f86952d35c2f11c44051b3c196f49ce1727
SSDEEP 12288:sHCg7t231kNu3JbxUUDuVFkzZry9+clw8NQBXkomWu:sig7t4kWUKuVmUaz
TLSH
T17625928167F90258F6FBBF706EB555614A7ABC9AAF34C28E1240451E0E72F91C970B33
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

142484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SetCurrentProcessExplicitAppUserModelID SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

kernel32

WakeAllConditionVariable WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetStdHandle GetFileType CloseHandle DuplicateHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetWindowsDirectoryW GetModuleFileNameW LocalFree CreateFileW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFinalPathNameByHandleW ReadFile SetFilePointerEx MultiByteToWideChar WideCharToMultiByte CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW SetEndOfFile WriteFile SetLastError GetProcessTimes GetCurrentProcessId GetCurrentThreadId GetProcessHandleCount GetSystemTimeAsFileTime GetTickCount64 GetNativeSystemInfo GetModuleHandleW GetProcAddress MoveFileExW FileTimeToSystemTime K32GetProcessMemoryInfo GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo ExitProcess HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetStringTypeW IsValidCodePage

Name

.text

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

620KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ca3956cd0238a83e6b1eb68dac34670d50f6d772c5e34d943461a2f6a0625068

shell32

ole32

bcrypt

kernel32

generic