fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24

Sharing

Copy URL Twitter E-mail

General

Target
fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24
Size 57KB
Sample261113-11eksshs7x
SHA256 fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24
MD5 3c69954a5a52fed80baa22072bc8048b
SHA1 5317032b95c8dab0316542726806f74de78fc621
SHA512 984d025da0241592c200bf4dba1a4e1a7558ec049df8a24d4b4fec9d43c598dd8174c6e52056b5be4f51e3a7503b9c8c97a3155fbd36a5fa15c050231288280d
SSDEEP 768:BNU6Resp5gFeOWOrNzYQ6ZEnJnU74zXQHLvPmrahf3:BUo5gTWOrNh6qJakXULvurQf
TLSH
T14743855293EA10C4F6F3A735457A21223A737D915B34CACF424C986A1FB3FE0A934766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24

File Explorer

fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24

.exe 57KB

fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24

IMPHASH ae1b5792a9c0b12184d898fc9020038b
SHA256 fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24
MD5 3c69954a5a52fed80baa22072bc8048b
SHA1 5317032b95c8dab0316542726806f74de78fc621
SHA512 984d025da0241592c200bf4dba1a4e1a7558ec049df8a24d4b4fec9d43c598dd8174c6e52056b5be4f51e3a7503b9c8c97a3155fbd36a5fa15c050231288280d
SSDEEP 768:BNU6Resp5gFeOWOrNzYQ6ZEnJnU74zXQHLvPmrahf3:BUo5gTWOrNh6qJakXULvurQf
TLSH
T14743855293EA10C4F6F3A735457A21223A737D915B34CACF424C986A1FB3FE0A934766
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

__C_specific_handler __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _unlock _vsnwprintf _wcmdln _wcsicmp abort calloc exit fprintf free malloc memmove memset realloc signal strlen strncmp vfprintf wcslen wcsncmp

kernel32

DefineDosDeviceW DeleteCriticalSection EnterCriticalSection FillConsoleOutputCharacterW FindResourceExW FlushFileBuffers FormatMessageW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetFileType GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource QueryDosDeviceW QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCursorPosition SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fdb25a945219a1b91ca16bb5dc0db0d20b3fb9de08bb76a0a38601ce48a15c24

msvcrt

kernel32

generic