6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355

Sharing

Copy URL Twitter E-mail

General

Target
6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355
Size 349KB
Sample261113-ce9xtae18r
SHA256 6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355
MD5 2a9b7c46e93d984d7b429c5d029c91d3
SHA1 fa4977f1d3cc6fcb2bb34ff73efb04c413ed3c9c
SHA512 3eb248584cde880080f8567b4c0ea739bf6be0a745c5ff6aa491d1d90ec32992ba6690d731d95a3ae60780b11c67ba6a56934a4e23367f0d598f29cc0adfcebc
SSDEEP 6144:/CchHGsKlrZgRECqsUCtbDmUx9ctYnOcm7qAmONmSt8eT+ZRV7tDPxnFpi:KHngPUCtbDmWs+OzmS2DpXFpi
TLSH
T15D747C10F581C032D46E11712A29DBF6963C79705FB598CFBBC45EBB9E301C2A635E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355

File Explorer

6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355

.dll 349KB

6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355

IMPHASH 8da87a112d4781629ee1f86d22826986
SHA256 6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355
MD5 2a9b7c46e93d984d7b429c5d029c91d3
SHA1 fa4977f1d3cc6fcb2bb34ff73efb04c413ed3c9c
SHA512 3eb248584cde880080f8567b4c0ea739bf6be0a745c5ff6aa491d1d90ec32992ba6690d731d95a3ae60780b11c67ba6a56934a4e23367f0d598f29cc0adfcebc
SSDEEP 6144:/CchHGsKlrZgRECqsUCtbDmUx9ctYnOcm7qAmONmSt8eT+ZRV7tDPxnFpi:KHngPUCtbDmWs+OzmS2DpXFpi
TLSH
T15D747C10F581C032D46E11712A29DBF6963C79705FB598CFBBC45EBB9E301C2A635E2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106561

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\RDBuildPool\20260917-27058\Release\CLIADDLer.pdb

wininet

HttpQueryInfoW InternetCloseHandle InternetConnectW InternetReadFile HttpSendRequestW InternetOpenW HttpOpenRequestW InternetCrackUrlW

shlwapi

PathFindFileNameW PathFileExistsW

advapi32

GetNamedSecurityInfoW RegOpenKeyExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW SetNamedSecurityInfoW RegQueryValueExW

bcrypt

BCryptDestroyKey BCryptVerifySignature BCryptOpenAlgorithmProvider BCryptFinishHash BCryptGetProperty BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

crypt32

CryptImportPublicKeyInfoEx2 CryptDecodeObjectEx

kernel32

FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP WriteFile ReadConsoleW SetEnvironmentVariableW SetEndOfFile InitializeCriticalSectionEx WaitForSingleObject ReleaseMutex CreateEventW GetLastError SetEvent DeleteFileW CloseHandle ResetEvent DecodePointer DeleteCriticalSection SizeofResource GetModuleHandleExW LockResource LoadResource FindResourceW ReadFile CreateFileW LocalFree FindFirstFileW HeapFree EnterCriticalSection FindNextFileW LeaveCriticalSection InitializeCriticalSection FindClose HeapSize HeapReAlloc LoadLibraryW HeapAlloc GetProcAddress GetProcessHeap FreeLibrary OutputDebugStringW LoadLibraryA SetLastError CreateMutexW GetPrivateProfileStringW GetLocalTime MoveFileExW OpenMutexW CreateDirectoryW GetFileAttributesW SetFileAttributesW MultiByteToWideChar GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW WriteConsoleW GetStringTypeW WideCharToMultiByte EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetFileType ExitProcess GetModuleFileNameW GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

user32

wsprintfW

shell32

SHGetSpecialFolderPathW ord165

Name

.text

Size

270KB

Virtual Size

270KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6f803e11eee24441b2cf5c76e2ef7d6973f750bcf04dce12c2b0f787d5655355

wininet

shlwapi

advapi32

bcrypt

crypt32

kernel32

user32

shell32

generic