ec4ba8c17a5766247eec0e9f844bb805

Sharing

Copy URL Twitter E-mail

General

Target
ec4ba8c17a5766247eec0e9f844bb805
Size 2.6MB
Sample220207-spl7hadgb3
SHA256 e41578bc2d18e9eb7359e062697ecdf2ea32afc0bcbbece876b3b75b406eb619
MD5 ec4ba8c17a5766247eec0e9f844bb805
SHA1 75d2ad384f0d2a75c0453fff0461bf0d04ce7f35
SHA512 b92522d49fbbf1db0f422c0acef83076d0cf40e732ea4dc797dd05911435670ac7970ddd6be740757541d7ce6091b7de03ada746588cad4d9228a5785b7f39c1
SSDEEP 12288:FvHoAEalcKJi0FJyAjiTiiyuuXPz4ApaWkYi2h3zdsDxuDXdUq2YD4pa7+om6ob:RIAFlXnFlji4aWkYi2xzODg1
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

ec4ba8c17a5766247eec0e9f844bb805

.exe 2.6MB

ec4ba8c17a5766247eec0e9f844bb805

IMPHASH ce1fefb9db9874c220f50d96828c5e9a
SHA256 e41578bc2d18e9eb7359e062697ecdf2ea32afc0bcbbece876b3b75b406eb619
MD5 ec4ba8c17a5766247eec0e9f844bb805
SHA1 75d2ad384f0d2a75c0453fff0461bf0d04ce7f35
SHA512 b92522d49fbbf1db0f422c0acef83076d0cf40e732ea4dc797dd05911435670ac7970ddd6be740757541d7ce6091b7de03ada746588cad4d9228a5785b7f39c1
SSDEEP 12288:FvHoAEalcKJi0FJyAjiTiiyuuXPz4ApaWkYi2h3zdsDxuDXdUq2YD4pa7+om6ob:RIAFlXnFlji4aWkYi2xzODg1
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

4271

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

IsWow64Process K32GetPerformanceInfo K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MapViewOfFile MoveFileW OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus ProcessIdToSessionId QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SearchPathW SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait SleepConditionVariableSRW SleepEx SuspendThread IsValidLocale SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtectEx VirtualQuery VirtualQueryEx WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable Wow64GetThreadContext WriteConsoleW WriteFile WriteProcessMemory lstrlenW GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW HeapQueryInformation FreeEnvironmentStringsW GetEnvironmentStringsW CreateFileW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP FindNextFileW FindFirstFileExW FindClose GetFileType EnumSystemLocalesW GetLocaleInfoW CompareStringW GetDateFormatW GetCurrentThread GetStdHandle HeapValidate ExitProcess GetModuleHandleExW GetModuleFileNameW IsValidCodePage IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead InitializeCriticalSectionAndSpinCount InitializeCriticalSection InitOnceExecuteOnce HeapSetInformation HeapCreate GetWindowsDirectoryW GetVersionExW GetVersion GetUserDefaultLocaleName GetUserDefaultLangID GetUserDefaultLCID GetTimeZoneInformation GetTimeFormatW GetTickCount GetThreadPriority GetThreadLocale GetThreadId FreeConsole WideCharToMultiByte MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FindResourceExW VirtualProtect VirtualAlloc Sleep DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException SwitchToThread DecodePointer GetSystemInfo FreeLibrary EncodePointer InterlockedFlushSList InterlockedPushEntrySList GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW GetProcAddress GetModuleHandleW CreateEventW CloseHandle GetCurrentProcess EnterCriticalSection

user32

GetActiveWindow MessageBoxW AllowSetForegroundWindow CloseDesktop UnregisterClassA CreateDesktopW CreateWindowStationW DefWindowProcW DestroyWindow DispatchMessageW CloseWindowStation FindWindowExW GetMessageW SendMessageTimeoutW GetProcessWindowStation UnregisterClassW TranslateMessage SetProcessWindowStation SetProcessDPIAware CreateWindowExW RegisterClassW PostMessageW IsWindow GetWindowThreadProcessId GetUserObjectInformationW GetThreadDesktop

advapi32

SystemFunction036 SetTokenInformation SetThreadToken SetSecurityInfo SetKernelObjectSecurity SetEntriesInAclW RevertToSelf RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDisablePredefinedCache RegDeleteValueW RegCreateKeyExW RegCloseKey OpenProcessToken MapGenericMask LookupPrivilegeValueW IsValidSid InitializeSid ImpersonateNamedPipeClient ImpersonateLoggedOnUser GetTokenInformation GetSidSubAuthority GetSecurityInfo GetSecurityDescriptorSacl GetNamedSecurityInfoW GetLengthSid GetKernelObjectSecurity GetAce FreeSid EventWrite EventUnregister EventRegister EqualSid DuplicateTokenEx DuplicateToken CreateWellKnownSid CreateRestrictedToken CreateProcessAsUserW CopySid ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW AccessCheck

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

ole32

CoTaskMemRealloc CoCreateInstance CoUninitialize CoTaskMemFree CoInitialize

oleaut32

VariantChangeType SafeArrayDestroy VariantCopy VariantClear SysFreeString VariantInit SysAllocStringLen SysAllocString

shlwapi

PathMatchSpecW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

timeGetTime

Name

.text

Size

845KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

190KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ