3b6b0fb5fad4af4841568076654d878f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3b6b0fb5fad4af4841568076654d878f.exe
Size 585KB
Sample221111-d3l2bsagbp
SHA256 f3c914e28bcd35f0b7b07892ac06dcf95d6b4300a658d78bba59ea4d178a70f4
MD5 3b6b0fb5fad4af4841568076654d878f
SHA1 7e7bbf35b3cbba29cfa6fbffd780404cd46783d0
SHA512 63098f50a97b61f945320473063b5ee419b1e2704eb1c45eebc1f5056385709bdbcecc67cfab279609446c9401932ba11d83060c0239a2a791f72e8574897af8
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxc:ZAT1BWEtBVUNiMm
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

3b6b0fb5fad4af4841568076654d878f.exe

.dll 585KB

3b6b0fb5fad4af4841568076654d878f.exe

IMPHASH bf309f28e2e75a572eb2f2244be62b26
SHA256 f3c914e28bcd35f0b7b07892ac06dcf95d6b4300a658d78bba59ea4d178a70f4
MD5 3b6b0fb5fad4af4841568076654d878f
SHA1 7e7bbf35b3cbba29cfa6fbffd780404cd46783d0
SHA512 63098f50a97b61f945320473063b5ee419b1e2704eb1c45eebc1f5056385709bdbcecc67cfab279609446c9401932ba11d83060c0239a2a791f72e8574897af8
SSDEEP 12288:vocAHzfdBuh0PBGEhq6FJxJ/3UEoiMxc:ZAT1BWEtBVUNiMm
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows x64

Minor OS version

Major OS version

Entry point

15144

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA InvalidateRect GetMessageW DefWindowProcW DestroyWindow CreateWindowExW RegisterClassExW LoadStringW ShowWindow DispatchMessageW SetGestureConfig GetGestureInfo TranslateAcceleratorW TranslateMessage LoadCursorW PostQuitMessage UpdateWindow BeginPaint EndPaint CloseGestureInfoHandle ScreenToClient

gdi32

Polyline LineTo CreatePen MoveToEx DeleteObject SelectObject

ole32

CoLoadLibrary

crypt32

CryptStringToBinaryA

kernel32

GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc GetFileSizeEx WriteConsoleW SetConsoleCtrlHandler GetFileType GetStdHandle GetProcessHeap EnumSystemLocalesW SetFilePointerEx ReadFile ReadConsoleW OutputDebugStringW CreateFileW HeapSize CloseHandle GetUserDefaultLCID IsValidLocale GetStringTypeW DeleteCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCurrentThread HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW

ACKZMHIObnaQHKwlzPq AOVudbyKxJVZeQMXsOLO AYyJBXGifeSEtCQk AhOoclQccPuG BkVECfpqiLatpcAjjeEXOZfyXY Bnyskkwd BwmAydmTqsNeDELdYUdLwTih CYNaQxtMawBMSIzdZWbTGpErba ConsmUhFFyb CzQwMEDCqCtUXGrJoKOLql DJCyeSXwKMnRyfbsSLCKxPpa DWugusOEsHPtXKgDd DfOfLuSCMIvgQaJYk DfkbPshiZaYhOSaqjIqPzONzY DllRegisterServer DnmCJIXEMkYokzeRRfG EKbIjoXzthxYq EWsrDBYLifLIKCx EYRKsLUkgMAWuxrfaIJmSgUBLc EfTrrBRRqguoDIjHNVAsJ EfiQnj FHJZnjTrtY FNDTVN FPWBMLNUrKgqAM FSOTatWmqbOxAfLsjwDimOJuI FVrtzByTqOLDyxlp FWyuZZnJq FbRCkW FtrghRYdy FunHXBytaEElTSmUSQaxzW FyjmimNSHaN GFvfuuOTsiXRZem GQuEvZTMELOxgCfrdhLu GTAOBqoXXNUuwQk GXBXUVZCqiUSlXidXO GpVGqWWnqIQjvlapeLvmZfi HKiZorFwnyyKVvRyl HQChNQSgCDQFBj HSHotINBWmzydlPTEIfsXGwf HVltrVWSPTyRN HbmDTfXglURaCPuXXtLWU HmUBBZu HnPoMgPYcGNsOhwCJGXNIe IDcRKhVmGJDZIQUlXXSXviO IFKCtEkfbx IHwQGYmyDi IJrjGqhERio IJtycxPsTSa IZsbRuJSZRMQltptMtlTIjq IemmPHlIUKfWUEFjL IoBQwhYmCRZqMXpUaubCn JJUbACbSOWX JJsDDeNgoEWNWyBpXLgKa JTTXkkGF JlCiEpVZnS JnmiFnk JprrRmuaDn KEekdWh KHEZQjbrCpYNETUhvaqOH KRPfoFibPSzSrtMziDiZJMjpEk KZqNGoq LQjcpeEdSdviWRBnc LXjroPDxbnZvuHAaofawR LcvIvMcywgnRCiIHovfshoSI LeBqVZwmAMKFKJEYOao LhjWUlVqYLdqrpdT LpnuGzVsvTJPoNZtEU MKiBXwXJxM MMbpxrmFfmd MNJtcYtYTpkhtNJwmsGayBExl MbSqjor MlUEOKTwxQO MmNhNY MtZNktTtZeSsetQdMIobnqgJN NDzloBRTiOCzFqnDESlYiGJz NHdMlFCbsRIZHAlXLut NylPFThbliBOEyrujKtyjpW OGGltngRdRjeETLJuyE OMhWNPrtGvXrDc OXTIbdKaaFNFhpZoL OmcpNNkGQNlfySxzyKHLT PBXSLAddeyA PDTTTYnwZWtmvgsDhQsjZU PRnncKInMtiadcjSSOQMFBQ PTqVRIJDpUraWiQ PrQvtewtRmO QGzPJQYQmszmRrRK QSZlVaTGjIxGWOeZfGN RDswoygaJbJWfRato RStXZYXYudckPDHz RgqjGZSoUeEcIqnMvAU SFcQiGXaye SJVNBxANqxZOkCrdHcqd SKGYjRmKvjRyc SOrXsIFXOx SpMHiyCka SwRuhANDGtYeZvIvL TEXYMBzoUnbpqCNMtncyH TNIcGjIUdTpSRDDkLMLiSmMzjL TPWLClLTaJmbJ TvNJOHLJssnMTyGMYYfTRZkQfY TviEPpUFMOuUAzSe UNNICJvBjyUFXwAOWRR UPNJpwqsqZmrRvPv VSCiqDUzUFFEzRcrCcWUIyxW VZZOFVhvSPFWJPbDSgML VrvAiARvhpsioDTvCsDpBWulVj VwTwbiJHhVyxhwrqGO WQOHTkDrFPqAa WRbhXlsUMohyHwwIcen WbAqAdgWVyvU WbVnejTmAenfcQVIpnq WfvnosCpZU WniHGai WoHUOvKkHgGCLHAfQWqMp WrenSYFI WxbfuHhPfdKZdIwvT XCQdNrvyrBIWZmxBXQ XGweHugOKIsErBIXlQtoAf XPdTfv XeJMUhn XgIYUiiYvZqAYkCpBzIRepfusc XxxGZdkAjnOvfCGXaUp YBwmARMK YFIukFX YIEzPijPuSEUDublpbKSuo YMDJlOFuodaYAQLeGQkc YWtaIGvg YfUzklBKELBicHcyYN YjskFIhoFvtxplXgXtnfIf YnhRnVOJVBWcCRg ZHJCTtneVBcLxFiFnGg aIjZFMDS aMTTokAjPrlPNl aQixWbkkl aauGXTnoHerQPEAdpmbxW aqXPJQsGuQNY bKpSPr bkIIqsWVbyUjvq bpwKexxmwQXToabxrI buYYvJRiQBDrx bwKTgNcwzNCMMazxQnksgPoMYH cIWTVLVTkeeCrLMzOeeRZrGJSv cIggJm ceCdpaLIInGREyzrMnutvv ceMUenqSerxOIsyip cyFldXcQbpghTEMTx dOcHvEogkqlHGvXiyXDlb dcBcGkFtILZfVKGjwlp dieMqBUxL dseZAioHVrcmpyJiL eQeKgkbvLQvnFKFOHCrntYX eSncnJDMjHJgWfLETuvOrPwuX eVWxywjPCGLxjCmBqwiSHDmQ eZJKYQozWFVwxNEiBgKs eZpNtEcqYmYlHr einEDhZnOdZQrqsLeDT ekpgkrLywwy eksViUURftndlwRdwIOqJPqDbM frcgaAFkyvENrvcg fyBPxsvBwdDxNn gcoxAPyjuxZE giCfzkFJgbNQVgrGIg hkTCpTyWVfVskuIaLTwIdI hkhQezBRO hlJDgJZgKgSWhsjKu hwtxKkvclLfqYPlzuN hwxxBxRyxQvU hytdxlppfBzgJ iGYEbafnUGwaqzLwiEkDcEoFXc iGYlltWJoEZkQUuBZjn iPQPztCACXTCftDZTvNvjn idIPfAiQBpOOJt iqDXnYKHYuvKDk isQnIHOKAYStRuHNa jRGQIAgrasRFSKFjASMTRGjUAQ jbtWQsliCJlKJi jxFwRFjTxqZBeWyYyGUjJht kJiLoUyRaJSlGAQwQY kXCRbDFCWsWkgDZ knVlSRpuMXigHbteRSdN lFuQHVlMqkcpyquJwPy lShqxKkjpAzGfSkJhI lUawyisBWFPUEeYWPOsrwiE laANAlWCv lkGHxNVNbj lsAeLBJdMVmYYItQoJSvCRYH lygWnYwnRJeU mIfOwaNjapchucclSR mYMzZFRyhlLMj mqDuazu nGtnIzcC nWOEkAFtcfB nucLASLksxzsTOm nvMQpNuTqWTeGVaTRoGxbvqP oRLRCOOs obtutjxbDeJGmWXwrNJO ogHMlfmoMSWiLsw ogYQVDGHrtTXPfRS ojDemZqmxKRkSOPmqat pKXkqiQt pZosDkvKboDlpSeaEkq qWEuWVdjXRrRKsKgJReOLq qWXEkPM qkRSaAJ rEPTSIjZh rSJyHvLUOTZicMruxCvEGoHc raNMBQY risZAsSaIagieXrdZnOhDzYIOB ruuEEEOFWCU sHmlVkEuiFuMGKlJpwXdZx sVJjsSsGPX sfUPtIbRemdA sqcseOa tILyVSAhgCdrEHfPBfVtFyoi tPjnuDplapdPIcrqZRmFXK tXfRwwpgGyZPDKAjlNIXEtOWG tkSvHbCTSiszhkEsUzPu tnLzaHFO tpEZEjlvmSwPCfGBwV tuYBrkIdkvGeYBclqo uYRaNlNJkGdzz ulHKyMUqbCPZAAnMrkdggm urRIlPSgdtAFARiFapAop urbspxQGSLCjnzsgbM utGMzHLpjYPEvUwmqbMaXd vRJFekacz vZXxIAQsf vhilLLLSQAgorQlDYcrg vjySCWm vxGqOYVxeIQzHyntqWqhQk vyEVtiIRlJmXCZssjhwmvCSgCi wQVxSUwsFAtnvfvsRKP xDofRk xFSCNuFr xNdkmblWjdxgkFdiybZ xaKbvIFmKuHEoQWRK xlqihUCH xuhPWlfWSOvzDpLXCOqs yBaBzgnZJat yNjzoWhmYhDVouThktWX yVPAgpehBiCzOhTsXpBCKvKh yZEOJgzErmiOalDcqbqqDtPb ycObxXXeiPKAAyH yeWcDVvwyxEtlDMveHTXhTdOct ynHEUiKCFMINWfolddVsmMgYDs zCGWJxJejbcdgDMKVsDv zNEbsppOqODrSjTVrDiLrOtygu zNJRmDXDLDbdIKXouATLf zloZBAmto zvTLkjiEXqTKQtLGxHslDrtLr