5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86

Sharing

Copy URL Twitter E-mail

General

Target
5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86
Size 413KB
Sample261113-ce9xtayy3m
SHA256 5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86
MD5 08c2d1e6fbd21a6652a734d18afd1fa3
SHA1 0ba69339d936ba73d3f5685584a7745f492bd297
SHA512 c677c99725878033ab2092f64e8b866c738ab3129cc469eca12f5038aa3670f318332dc9eb1c69e64ad2a05955a86cbd088ece2e45eef62c1ef7c0e6263b334b
SSDEEP 6144:mTWFayZw0rktR50UgIqRCLs8tCJz/VP00+qWgBY0e1zjUvPLDwhCq:bFSOktRmUuCLs8EJjjcjUnL
TLSH
T11B948D55F3E404B9E5B79238CE638602E7B6B8190770D7DF13A096662F23BD05A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86

File Explorer

5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86

.dll 413KB

5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86

IMPHASH 01f8b03d905f1b15085b7d709790f248
SHA256 5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86
MD5 08c2d1e6fbd21a6652a734d18afd1fa3
SHA1 0ba69339d936ba73d3f5685584a7745f492bd297
SHA512 c677c99725878033ab2092f64e8b866c738ab3129cc469eca12f5038aa3670f318332dc9eb1c69e64ad2a05955a86cbd088ece2e45eef62c1ef7c0e6263b334b
SSDEEP 6144:mTWFayZw0rktR50UgIqRCLs8tCJz/VP00+qWgBY0e1zjUvPLDwhCq:bFSOktRmUuCLs8EJjjcjUnL
TLSH
T11B948D55F3E404B9E5B79238CE638602E7B6B8190770D7DF13A096662F23BD05A3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\RDBuildPool\20260917-27058\x64\Release\CLIADDLer.pdb

wininet

HttpQueryInfoW InternetCloseHandle InternetConnectW InternetReadFile HttpSendRequestW InternetOpenW HttpOpenRequestW InternetCrackUrlW

shlwapi

PathFindFileNameW PathFileExistsW

advapi32

GetNamedSecurityInfoW RegOpenKeyExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW SetEntriesInAclW SetNamedSecurityInfoW RegQueryValueExW

bcrypt

BCryptDestroyKey BCryptVerifySignature BCryptOpenAlgorithmProvider BCryptFinishHash BCryptGetProperty BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider

crypt32

CryptImportPublicKeyInfoEx2 CryptDecodeObjectEx

kernel32

FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle FlushFileBuffers GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP WriteFile SetEndOfFile WriteConsoleW WideCharToMultiByte InitializeCriticalSectionEx WaitForSingleObject ReleaseMutex CreateEventW GetLastError SetEvent DeleteFileW CloseHandle ResetEvent DecodePointer DeleteCriticalSection SizeofResource GetModuleHandleExW LockResource LoadResource FindResourceW ReadFile CreateFileW LocalFree FindFirstFileW HeapFree EnterCriticalSection FindNextFileW LeaveCriticalSection InitializeCriticalSection FindClose HeapSize HeapReAlloc LoadLibraryW HeapAlloc GetProcAddress GetProcessHeap FreeLibrary OutputDebugStringW LoadLibraryA SetLastError CreateMutexW GetPrivateProfileStringW GetLocalTime MoveFileExW OpenMutexW CreateDirectoryW GetFileAttributesW SetFileAttributesW MultiByteToWideChar ReadConsoleW GetConsoleMode SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetStringTypeW RtlUnwind EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetFileType ExitProcess GetModuleFileNameW GetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW

user32

wsprintfW

shell32

SHGetSpecialFolderPathW ord165

Name

.text

Size

296KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5e8d0edb25a219f8fe8b9571db93f0309f1be6c9ff592b722c4ee5c41d880c86

wininet

shlwapi

advapi32

bcrypt

crypt32

kernel32

user32

shell32

generic