dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6

Sharing

Copy URL Twitter E-mail

General

Target
dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6
Size 387KB
Sample261113-2ffg2asw7m
SHA256 dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6
MD5 a2d36dd28ad9f82c5f94a8cc6a8a9778
SHA1 a25eef21e7ece5a353031bd60f112424c2aef7c3
SHA512 7354fc1419ebb59984133af904179ba980eb5f075e14e11de2d83eb7e8345d0491c63cea03080c4f8c03ff2d4a645204d6ae409eef6fca627a59ed5c5943546b
SSDEEP 3072:xkTa6gHenJAGm+ZwDKXbBsQBbByFnOBe409tUS2YBloA3BYdibB8nZK:xH6qeJAGXfB4nfH2BACiB
TLSH
T1B484145263FE0118F6F73B7459B992794A377D96A93DC64D029C210E4BE3E409E20BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6

File Explorer

dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6

.exe 387KB

dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6

IMPHASH cb3f89ad746176d313268a6409e2d3f9
SHA256 dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6
MD5 a2d36dd28ad9f82c5f94a8cc6a8a9778
SHA1 a25eef21e7ece5a353031bd60f112424c2aef7c3
SHA512 7354fc1419ebb59984133af904179ba980eb5f075e14e11de2d83eb7e8345d0491c63cea03080c4f8c03ff2d4a645204d6ae409eef6fca627a59ed5c5943546b
SSDEEP 3072:xkTa6gHenJAGm+ZwDKXbBsQBbByFnOBe409tUS2YBloA3BYdibB8nZK:xH6qeJAGXfB4nfH2BACiB
TLSH
T1B484145263FE0118F6F73B7459B992794A377D96A93DC64D029C210E4BE3E409E20BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CloseServiceHandle ControlService EnumServicesStatusW OpenSCManagerW OpenServiceW StartServiceW

netapi32

NetApiBufferFree NetGroupAdd NetGroupAddUser NetGroupDel NetGroupDelUser NetGroupEnum NetGroupGetInfo NetGroupGetUsers NetGroupSetInfo NetLocalGroupAdd NetLocalGroupAddMembers NetLocalGroupDel NetLocalGroupDelMembers NetLocalGroupEnum NetLocalGroupGetInfo NetLocalGroupGetMembers NetLocalGroupSetInfo NetServerGetInfo NetServerSetInfo NetServerTransportEnum NetSessionDel NetSessionEnum NetShareAdd NetShareDel NetShareEnum NetShareGetInfo NetStatisticsGet NetUserAdd NetUserDel NetUserEnum NetUserGetGroups NetUserGetInfo NetUserGetLocalGroups NetUserModalsGet NetUserModalsSet NetUserSetInfo NetWkstaGetInfo NetWkstaTransportEnum NetWkstaUserGetInfo

mpr

WNetCancelConnection2W WNetCloseEnum WNetEnumResourceW WNetOpenEnumW WNetUseConnectionW

msvcrt

__lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _swprintf _unlock _vsnwprintf _wcmdln _wcsicmp _wcslwr _wcsnicmp abort calloc exit fprintf free iswctype malloc memmove memset printf qsort rand realloc signal srand strlen strncmp towupper vfprintf wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsncpy wcspbrk wcsstr wcstol wcstoul

kernel32

DeleteCriticalSection EnterCriticalSection FileTimeToLocalFileTime FileTimeToSystemTime FillConsoleOutputCharacterW FindResourceExW FlushFileBuffers FormatMessageW FreeLibrary GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetFileType GetLastError GetLocaleInfoW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MultiByteToWideChar QueryPerformanceCounter ReadFile RtlUnwind SetConsoleCursorPosition SetConsoleMode SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte WriteConsoleW WriteFile

ntdll

RtlAllocateHeap RtlFreeHeap RtlGetNtProductType RtlSecondsSince1970ToTime RtlTimeToSecondsSince1970

Name

.text

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symz

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dfae5ce2ced4cc07337e7ee84e125c769d5e747837dacb5c12fea50c74d491a6

advapi32

netapi32

mpr

msvcrt

kernel32

ntdll

generic