a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58

Sharing

Copy URL Twitter E-mail

General

Target
a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58
Size 69KB
Sample261113-14d4fasv2n
SHA256 a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58
MD5 9e3de81482b838ccfd70cf744c5c1100
SHA1 8ffb59c711d270ae7601b78fcaac293bc61ef631
SHA512 e8a245cf9465f95d6dfff18b4522794d38628f450bf2a5cd57caa16364197048c7a19fad950a3f8712c4c7344a678619a2a60a2b78883a4be7c8ca01c5d8aaa1
SSDEEP 384:dLWFPD75YRWDV2HIUnLBp1I95RMuQkfBwn3w72YPvbpVrP7JcOdGMxzLPql+E9gC:dL2n0tpWbwA7n3bpRhdnxXPql+EnIZv
TLSH
T157633905A2E6D3DEC57A423D0CF296A1B839B9651B3046CF2A50654F0F31FF49A3B7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58

File Explorer

a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58

.dll 69KB

a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58

IMPHASH 01d1dce8da9d68f8e8b253d5f0e8b067
SHA256 a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58
MD5 9e3de81482b838ccfd70cf744c5c1100
SHA1 8ffb59c711d270ae7601b78fcaac293bc61ef631
SHA512 e8a245cf9465f95d6dfff18b4522794d38628f450bf2a5cd57caa16364197048c7a19fad950a3f8712c4c7344a678619a2a60a2b78883a4be7c8ca01c5d8aaa1
SSDEEP 384:dLWFPD75YRWDV2HIUnLBp1I95RMuQkfBwn3w72YPvbpVrP7JcOdGMxzLPql+E9gC:dL2n0tpWbwA7n3bpRhdnxXPql+EnIZv
TLSH
T157633905A2E6D3DEC57A423D0CF296A1B839B9651B3046CF2A50654F0F31FF49A3B7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx

mpr

WNetCancelConnection2W WNetCloseEnum WNetEnumResourceW WNetOpenEnumW

shell32

ShellExecuteExW

user32

CopyImage DestroyIcon DialogBoxParamW EnableWindow EndDialog GetDlgItem GetSystemMetrics LoadImageW LoadStringW SendMessageW

msvcrt

_amsg_exit _fpreset _initterm _iob _lock _onexit _unlock abort calloc fprintf free memmove memset realloc signal strlen strncmp vfprintf

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetModuleHandleW GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRaiseException RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

ntdll

DbgPrint

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stubtxt

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a5adc1a0579b96eba5056549cc6bd1c304f13d2fefa07bf6bb770cfc6d307f58

comctl32

mpr

shell32

user32

msvcrt

kernel32

ntdll

generic