1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da

Sharing

Copy URL Twitter E-mail

General

Target
1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da
Size 141KB
Sample261113-2awbashv91
SHA256 1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da
MD5 81fea3664d0419ef9679d52cdae9ea88
SHA1 9d83182222980f33ff76185000d8623646e6b302
SHA512 bf8eb999e9636139650fa7e220184505a0266aac66b56b631f745e85f4ee58e870c262ad744ea806de54d97a05fc7ded5667b8aa77ceca19c14edbd271925c3c
SSDEEP 3072:vJWh7kcZPwSVVoKZWNHxwMBCKULKQ8a5:v4kcdjX8a5
TLSH
T1F1E3F9026BAE68F4E17ACAF505F3AE531D753C470BF482DB1764E60D2EB1AC05AB4352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da

File Explorer

1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da

.dll 141KB

1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da

IMPHASH 2b3079b96f919ea71c8540b909ace9ac
SHA256 1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da
MD5 81fea3664d0419ef9679d52cdae9ea88
SHA1 9d83182222980f33ff76185000d8623646e6b302
SHA512 bf8eb999e9636139650fa7e220184505a0266aac66b56b631f745e85f4ee58e870c262ad744ea806de54d97a05fc7ded5667b8aa77ceca19c14edbd271925c3c
SSDEEP 3072:vJWh7kcZPwSVVoKZWNHxwMBCKULKQ8a5:v4kcdjX8a5
TLSH
T1F1E3F9026BAE68F4E17ACAF505F3AE531D753C470BF482DB1764E60D2EB1AC05AB4352
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

msvcrt

_amsg_exit _fpreset _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf abort bsearch calloc fprintf free memcmp memmove memset realloc signal sprintf strchr strcmp strcpy strcspn strlen strncmp vfprintf wcschr _wcsicmp wcsrchr

advapi32

CredEnumerateW CredFree CredWriteW

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetRectEmpty SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow

comctl32

ord413 InitCommonControls ord412 ord410

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar QueryPerformanceCounter RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlRaiseException RtlVirtualUnwind SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery lstrcmpW lstrcpyW lstrlenW

ntdll

DbgPrint RtlAllocateHeap RtlFreeHeap RtlReAllocateHeap vDbgPrintExWithPrefix

Name

.text

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.stubtxt

Size

1024B

Virtual Size

754B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1d11bc21589452e059179e6354070440d1b40f8d9c5d112374fed1a684d986da

msvcrt

advapi32

user32

comctl32

kernel32

ntdll

generic