9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c

Sharing

Copy URL Twitter E-mail

General

Target
9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c
Size 379KB
Sample261113-2edbaasw5q
SHA256 9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c
MD5 5e5d1a31fa8e0db9ca3d730d5d1ee560
SHA1 0892b45418847f682f88f91d15aac1b1a7a7a35c
SHA512 e103846b9f012f5123eba6aa726bed9d656d0ed455d094dd27e01ccd041593cd11f7ba76f79d519cdd00e6e90d1fcb35af0a0460ffe1c5536cd63ee571454117
SSDEEP 3072:NXriXDtojmuP8Lyw84NpYff91Vvh2CEDpv33No+UacyeXpdBEbFO+3:wuSuPS04glp2CEDFFd3
TLSH
T1BC84B95213EB4219F6F33F795DBA45684F3BBDA2AD36C21E219C412E4FB3540A970722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c

File Explorer

9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c

.exe 379KB

9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c

IMPHASH 8501516b67dc6084a31f0b5fe4a2c7f4
SHA256 9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c
MD5 5e5d1a31fa8e0db9ca3d730d5d1ee560
SHA1 0892b45418847f682f88f91d15aac1b1a7a7a35c
SHA512 e103846b9f012f5123eba6aa726bed9d656d0ed455d094dd27e01ccd041593cd11f7ba76f79d519cdd00e6e90d1fcb35af0a0460ffe1c5536cd63ee571454117
SSDEEP 3072:NXriXDtojmuP8Lyw84NpYff91Vvh2CEDpv33No+UacyeXpdBEbFO+3:wuSuPS04glp2CEDFFd3
TLSH
T1BC84B95213EB4219F6F33F795DBA45684F3BBDA2AD36C21E219C412E4FB3540A970722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

__lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _errno _fpreset _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf _wcmdln _wcstoui64 _wfopen abort bsearch calloc exit fclose fprintf fread free iswctype malloc memcmp memmove realloc signal sprintf strchr strcmp strcpy strcspn strlen strncmp strpbrk towlower towupper vfprintf wcschr _wcsdup _wcsicmp wcsncmp _wcsnicmp wcspbrk wcsrchr wcsstr wcstoul _wcsupr

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

user32

LoadStringW

kernel32

CloseHandle CreateFileW DeleteCriticalSection EnterCriticalSection FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetModuleHandleW GetOEMCP GetProcAddress GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar QueryPerformanceCounter ReadConsoleW SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW lstrcmpiW lstrcpyW lstrlenW

ntdll

RtlAllocateHeap RtlFreeHeap RtlReAllocateHeap vDbgPrintExWithPrefix

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

313KB

Virtual Size

312KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9d171715d8875f9346806713d02f7969c5c61a45afa93445718c8f5a7f98b57c

msvcrt

advapi32

user32

kernel32

ntdll

generic