b2f3a9acd3ae06bbe2441ecafd705cdd

Sharing

Copy URL Twitter E-mail

General

Target
b2f3a9acd3ae06bbe2441ecafd705cdd
Size 667KB
Sample220512-183mladfbm
SHA256 0749ae4fbaba4c32165fe6a257b19a932fa89ffa0a5831d8ffad9b47725b2d18
MD5 b2f3a9acd3ae06bbe2441ecafd705cdd
SHA1 fd12113bdb88044f8fbe49b5af196bd62170065a
SHA512 766e44203359f682e2fe04eee4b115a6c1e0083077ccfc8a27b8c85473364dc05cbb5585f5c229886af3c94c76ea3222c613e63ab42ccbe87865707180d86825
SSDEEP 6144:mkajLyaPIvW1TFpvzYNB1MLB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN846nnKg6vxaEHubqLjpq
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

b2f3a9acd3ae06bbe2441ecafd705cdd

.dll 667KB

b2f3a9acd3ae06bbe2441ecafd705cdd

IMPHASH e8d4871e5b3e8b61e21cf4b7ceafb1f5
SHA256 0749ae4fbaba4c32165fe6a257b19a932fa89ffa0a5831d8ffad9b47725b2d18
MD5 b2f3a9acd3ae06bbe2441ecafd705cdd
SHA1 fd12113bdb88044f8fbe49b5af196bd62170065a
SHA512 766e44203359f682e2fe04eee4b115a6c1e0083077ccfc8a27b8c85473364dc05cbb5585f5c229886af3c94c76ea3222c613e63ab42ccbe87865707180d86825
SSDEEP 6144:mkajLyaPIvW1TFpvzYNB1MLB6ng7AzjDxFkfioa6wdcnOcaEA8eAFKiwbTOLjNW9:0yaQMTFN846nnKg6vxaEHubqLjpq
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

84684

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d2d1

ord3 ord1 ord2

propsys

PropVariantToUInt32 PropVariantToUInt32WithDefault

comctl32

ImageList_LoadImageW ord344 ImageList_Destroy

kernel32

GetCommandLineW CreateDirectoryW GetLastError CopyFileW GetModuleHandleW GetModuleFileNameW SetFilePointerEx GetConsoleMode VirtualAlloc WriteFile FlushFileBuffers SetStdHandle HeapSize GetStringTypeW GetFileType GetConsoleOutputCP CreateFileW WriteConsoleW GetStdHandle GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapReAlloc EncodePointer GetTempPathW DeleteFileW CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

user32

SetCapture GetSystemMetrics LoadImageW SendMessageW PostQuitMessage SetFocus LoadStringW ReleaseCapture LoadCursorW SetCursor GetClientRect LoadIconW GetCapture GetMessageW SetWindowTextW UpdateWindow CloseWindow SetWindowPos TranslateMessage DispatchMessageW BeginPaint EndPaint TrackMouseEvent GetGestureInfo CloseGestureInfoHandle SendNotifyMessageW GetParent GetCursorPos WindowFromPoint IsChild RegisterClassExW CreateWindowExW SetWindowLongPtrW GetWindowLongPtrW DefWindowProcW ShowWindow GetWindowRect InvalidateRect

gdi32

DeleteObject

advapi32

RegCloseKey RegOpenKeyW

shell32

SHCreateItemWithParent SHCreateItemFromParsingName CommandLineToArgvW ShellExecuteExW SHGetKnownFolderItem SHCreateItemInKnownFolder SetCurrentProcessExplicitAppUserModelID SHAddToRecentDocs ord155

ole32

CoUninitialize CoCreateInstance CoTaskMemAlloc CoInitialize CoTaskMemFree

dwrite

DWriteCreateFactory

Name

.text

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ