f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b

Sharing

Copy URL Twitter E-mail

General

Target
f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b
Size 124KB
Sample261113-h2qekshs9q
SHA256 f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b
MD5 100dad8a04be54e7e1a8c5a0e8077a20
SHA1 978d86e32fb738b5e341bd0f7f211a9156077cd7
SHA512 a3ec665af4b64f2563f624dc4fc3bf18ae87e18658e212fcc13814baa91e744527e81acb382bce24a5ff0a1afaaac66d73dddcc30428c83ce7308cafe95e48de
SSDEEP 3072:TjtKaUcerP5LdkCHLIAVCTJ/+5gG+am4AC:TjsaBeD5dkCjQbG+B4AC
TLSH
T112C396D2B6E16CDDEA66917D819793337638FAD086138F138520A6321F13ED07DAE325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b

File Explorer

f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b

.exe 124KB

f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b

IMPHASH 7f7551d7f2248b992e05cc6911dbd862
SHA256 f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b
MD5 100dad8a04be54e7e1a8c5a0e8077a20
SHA1 978d86e32fb738b5e341bd0f7f211a9156077cd7
SHA512 a3ec665af4b64f2563f624dc4fc3bf18ae87e18658e212fcc13814baa91e744527e81acb382bce24a5ff0a1afaaac66d73dddcc30428c83ce7308cafe95e48de
SSDEEP 3072:TjtKaUcerP5LdkCHLIAVCTJ/+5gG+am4AC:TjsaBeD5dkCjQbG+B4AC
TLSH
T112C396D2B6E16CDDEA66917D819793337638FAD086138F138520A6321F13ED07DAE325
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

kernel32

AddVectoredExceptionHandler CheckRemoteDebuggerPresent CloseHandle CreateFileMappingA FindResourceA FlushInstructionCache GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetSystemInfo GetThreadContext GetTickCount64 LoadLibraryA LoadResource LockResource MapViewOfFile SetUnhandledExceptionFilter SizeofResource Sleep UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strcmp strlen

api-ms-win-crt-utility-l1-1-0

abs

user32

CharUpperA

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f2dd36d201e8f725838bfd388c51b1c734406d8d02edf348ebe690794466640b

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

generic