2955dafe8485f2ae43fa5417b24417adde0e8f7efd86ba0e4a64f91cedf552f0

Sharing

Copy URL Twitter E-mail

General

Target
2955dafe8485f2ae43fa5417b24417adde0e8f7efd86ba0e4a64f91cedf552f0
Size 1.2MB
Sample221127-3vttmsdb9w
SHA256 2955dafe8485f2ae43fa5417b24417adde0e8f7efd86ba0e4a64f91cedf552f0
MD5 2f5086b3362cd467978cfc80ef05c350
SHA1 51803a07f1d78c6feff15a8c5449f3f6782f0cb0
SHA512 3d32eb5b6bd3151f616e7eb79f8be4dad0d717be4944903a1c08ea59fa1ba2697d9342e87fc630f76a1c5405d9747c1c56a4a28cfc127e592e15c0963f9e3afb
SSDEEP 12288:ln+71c09TUMmK38igs0/1c05lHqia6jrUn68t1M38XWz6mWgxnImx/lFOlqewKCt:pAp9T8i+9c054isnzaDNd8lqewKCVpdX
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

2955dafe8485f2ae43fa5417b24417adde0e8f7efd86ba0e4a64f91cedf552f0

.exe 1.2MB

2955dafe8485f2ae43fa5417b24417adde0e8f7efd86ba0e4a64f91cedf552f0

IMPHASH cdd318e3621bd830b5d06391a540f358
SHA256 2955dafe8485f2ae43fa5417b24417adde0e8f7efd86ba0e4a64f91cedf552f0
MD5 2f5086b3362cd467978cfc80ef05c350
SHA1 51803a07f1d78c6feff15a8c5449f3f6782f0cb0
SHA512 3d32eb5b6bd3151f616e7eb79f8be4dad0d717be4944903a1c08ea59fa1ba2697d9342e87fc630f76a1c5405d9747c1c56a4a28cfc127e592e15c0963f9e3afb
SSDEEP 12288:ln+71c09TUMmK38igs0/1c05lHqia6jrUn68t1M38XWz6mWgxnImx/lFOlqewKCt:pAp9T8i+9c054isnzaDNd8lqewKCVpdX
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

783920

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ReleaseMutex ResumeThread FindAtomW SearchPathA FindResourceW GetComputerNameExW GetVolumeInformationW TlsFree SetFileTime GetFileType SetSystemTimeAdjustment GetAtomNameW GetStringTypeA ReadFile CreateMailslotA MoveFileWithProgressA SetConsoleOutputCP AddAtomW QueueUserWorkItem GetUserDefaultLangID GetLocaleInfoW FreeResource SetUnhandledExceptionFilter GetShortPathNameA GetSystemDefaultLangID GetTimeFormatW FindAtomA CreateSemaphoreW SetCalendarInfoA WriteConsoleW GetUserDefaultLCID FlushViewOfFile GetCurrentProcess GetNumberFormatW CreateNamedPipeW SetEndOfFile GetTimeZoneInformation GetDiskFreeSpaceW CreateToolhelp32Snapshot GetCPInfoExW OpenWaitableTimerA GetLongPathNameW GetConsoleAliasExesW GetStringTypeExW GetFileTime DeleteVolumeMountPointA MoveFileW SetCurrentDirectoryA ResetEvent SetTapePosition GetExitCodeProcess GetConsoleAliasesA SetConsoleTextAttribute GetNamedPipeInfo GetPrivateProfileStringW QueryInformationJobObject LocalFileTimeToFileTime CopyFileExA GetShortPathNameW Module32Next CreateTimerQueue CreateFileMappingW ConvertThreadToFiber CopyFileExW SetFileAttributesW GetSystemWindowsDirectoryW DeleteFileA SetErrorMode GetDevicePowerState FormatMessageW FormatMessageA MapUserPhysicalPages GetProcessPriorityBoost FindFirstFileExA DuplicateHandle GetConsoleAliasW OpenEventW SetThreadPriority GetDiskFreeSpaceA SetThreadExecutionState OpenSemaphoreA SetMailslotInfo ConvertDefaultLocale PeekNamedPipe GlobalDeleteAtom GetProfileStringW CopyFileW GetTapeStatus GetModuleHandleW GetDateFormatA GetFileAttributesExW GetLongPathNameA GetPrivateProfileSectionA SetLocaleInfoA DefineDosDeviceW SetStdHandle OpenProcess SetVolumeMountPointA GetProfileStringA MulDiv CreateWaitableTimerW ExpandEnvironmentStringsW ReadDirectoryChangesW CreateMutexW GetProcessIoCounters GetCurrentDirectoryA CreateMutexA ChangeTimerQueueTimer SetConsoleDisplayMode GetFullPathNameA HeapCreate GetUserDefaultUILanguage GetEnvironmentStrings InitializeCriticalSectionAndSpinCount FoldStringA FlushConsoleInputBuffer DeleteAtom CreateMailslotW TlsAlloc IsValidCodePage GetSystemDirectoryA DeleteTimerQueueTimer FlushFileBuffers CreateHardLinkW GetNamedPipeHandleStateW GetLogicalDriveStringsA SetProcessPriorityBoost BindIoCompletionCallback GetConsoleMode GetNumberFormatA GetLogicalDrives GetMailslotInfo GetVolumeNameForVolumeMountPointA CreateDirectoryA GetProcessVersion GetConsoleCursorInfo GetCurrencyFormatA GetVolumePathNameA WriteConsoleA SetConsoleMode FreeEnvironmentStringsW GetStdHandle FlushInstructionCache SetThreadAffinityMask GetVolumePathNameW GetWindowsDirectoryW GetModuleFileNameA CreateTapePartition SetThreadContext SetWaitableTimer GetThreadPriority IsDBCSLeadByte CreateJobObjectA DnsHostnameToComputerNameA CreateDirectoryExA SetLocaleInfoW GetDiskFreeSpaceExW LockFile lstrcmpW PrepareTape GetVersion LCMapStringW FreeEnvironmentStringsA SetProcessWorkingSetSize GetCommandLineW GetOEMCP GetCompressedFileSizeW EraseTape OpenJobObjectA CreateDirectoryExW FoldStringW OpenFileMappingA GlobalMemoryStatus GetFileAttributesExA ProcessIdToSessionId ReplaceFileW GetEnvironmentVariableW SetThreadIdealProcessor GetThreadLocale GetModuleFileNameW GetConsoleCP GetProcessAffinityMask GetCommandLineA GetFileAttributesA FindFirstFileA VerSetConditionMask GetOverlappedResult CancelIo GetComputerNameA SetCurrentDirectoryW GetPrivateProfileIntW ReleaseSemaphore GetProcessWorkingSetSize ReadProcessMemory SetCalendarInfoW CompareStringW FindResourceExW SetConsoleCP SetComputerNameExA MultiByteToWideChar GetConsoleScreenBufferInfo DnsHostnameToComputerNameW OpenEventA SetEnvironmentVariableA ReplaceFileA SetSystemPowerState CreateEventW SwitchToThread MapViewOfFileEx GetProfileSectionW VirtualAlloc GetDateFormatW GetBinaryTypeA GetLocaleInfoA FindNextChangeNotification EnumCalendarInfoExA Module32First GetConsoleAliasExesLengthW EnumCalendarInfoW GetSystemDirectoryW WideCharToMultiByte ExpandEnvironmentStringsA SetInformationJobObject DisconnectNamedPipe GetBinaryTypeW GetPrivateProfileStringA GetFileAttributesW GetThreadTimes GetNumberOfConsoleInputEvents

rpcrt4

RpcErrorAddRecord RpcBindingSetOption UuidHash UuidCreateNil RpcBindingServerFromClient RpcBindingSetAuthInfoA RpcBindingFromStringBindingW NdrFullPointerXlatFree RpcServerUseProtseqEpA NdrConformantStringMarshall MesBufferHandleReset RpcAsyncInitializeHandle RpcServerUseProtseqEpW RpcStringBindingComposeA IUnknown_QueryInterface_Proxy NdrStubCall2 RpcServerListen RpcErrorSaveErrorInfo NdrSimpleTypeMarshall NdrUserMarshalFree UuidEqual RpcBindingCopy RpcAsyncCancelCall RpcAsyncAbortCall RpcRevertToSelfEx NdrUserMarshalBufferSize NdrClientInitializeNew RpcServerInqDefaultPrincNameW RpcObjectSetType RpcMgmtEpEltInqBegin RpcServerUnregisterIf RpcEpRegisterNoReplaceW NdrFullPointerXlatInit NdrOleAllocate RpcStringBindingParseW RpcServerUseProtseqEpExW RpcMgmtStopServerListening RpcRaiseException RpcMgmtSetCancelTimeout NdrCorrelationFree RpcMgmtSetServerStackSize RpcErrorLoadErrorInfo MesHandleFree RpcServerRegisterIf RpcEpResolveBinding RpcStringBindingParseA RpcAsyncCompleteCall

user32

MessageBoxW GetAltTabInfoA SetCursor IsWindowUnicode EmptyClipboard EnumDisplayMonitors InvalidateRect InvalidateRgn CharUpperW SetMenuDefaultItem GetWindowTextA BringWindowToTop SystemParametersInfoW ValidateRect LoadStringW SetTimer GetClassInfoExW SetDlgItemTextW GetMonitorInfoW GetGUIThreadInfo DialogBoxParamW SetRect LoadBitmapW RemoveMenu SetFocus GetSystemMetrics IsDlgButtonChecked SendInput FrameRect CopyRect GetWindowDC DestroyWindow OpenDesktopW ClientToScreen SetProcessWindowStation GetMessagePos ActivateKeyboardLayout InsertMenuItemW RegisterClassExW ScreenToClient SendDlgItemMessageW DrawTextExW GetDlgCtrlID GetKeyboardState IsRectEmpty GetDialogBaseUnits LoadCursorW DrawMenuBar GetActiveWindow GetWindowLongW GetWindowTextW ShowCursor UnregisterClassW RemovePropW DestroyMenu SetDlgItemTextA EnumThreadWindows GetForegroundWindow LoadMenuA AdjustWindowRect GetThreadDesktop GetClassNameW SetDlgItemInt

comctl32

FlatSB_GetScrollInfo CreatePropertySheetPageA ImageList_EndDrag ImageList_Draw ImageList_GetIconSize FlatSB_SetScrollInfo InitializeFlatSB ImageList_ReplaceIcon PropertySheetW ImageList_SetBkColor ImageList_DrawIndirect DestroyPropertySheetPage ImageList_Add ImageList_Remove ImageList_LoadImageW ImageList_Create ImageList_SetImageCount FlatSB_GetScrollPos _TrackMouseEvent FlatSB_SetScrollPos ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragShowNolock ImageList_AddMasked ImageList_Copy InitCommonControlsEx PropertySheetA FlatSB_SetScrollProp ImageList_LoadImageA ImageList_Replace ord17 ImageList_Read ImageList_DrawEx CreateToolbarEx ImageList_GetImageCount ImageList_DragMove ImageList_GetBkColor ImageList_GetImageInfo CreateStatusWindowW ImageList_Write ImageList_DragLeave ImageList_GetIcon ImageList_SetIconSize ImageList_Destroy ImageList_GetDragImage CreatePropertySheetPageW ImageList_DragEnter ImageList_SetOverlayImage

advapi32

RegQueryMultipleValuesA RegConnectRegistryW RegSetValueA AllocateAndInitializeSid RegQueryValueExA GetSidLengthRequired GetAclInformation RegSetValueExA RegDeleteKeyA CryptCreateHash CryptAcquireContextA GetSecurityDescriptorControl GetKernelObjectSecurity GetAce DuplicateTokenEx OpenSCManagerW IsValidSecurityDescriptor CryptDestroyHash GetSecurityDescriptorDacl RegOpenKeyA RegOpenKeyExA CryptGetHashParam SetSecurityDescriptorDacl CheckTokenMembership RegEnumKeyA AddAce CryptAcquireContextW StartServiceA SetServiceStatus RegEnumKeyW AdjustTokenPrivileges LsaOpenPolicy SetTokenInformation RegSetValueExW InitializeAcl RegCreateKeyExA RegCreateKeyExW GetCurrentHwProfileW GetSidSubAuthority GetSidSubAuthorityCount SetKernelObjectSecurity InitializeSecurityDescriptor RegSetKeySecurity RegSetValueW AddAuditAccessAce AddAccessDeniedAce RegQueryMultipleValuesW GetTokenInformation AddAccessAllowedAce GetCurrentHwProfileA RegNotifyChangeKeyValue AreAnyAccessesGranted GetSidIdentifierAuthority AreAllAccessesGranted

shell32

ShellExecuteW SHGetFolderPathW SHGetMalloc SHGetSpecialFolderLocation ShellExecuteExW SHFileOperationW SHBindToParent CommandLineToArgvW SHBrowseForFolderW SHGetDesktopFolder SHChangeNotify SHGetSpecialFolderPathW SHGetFileInfoW

ole32

PropVariantCopy CoGetCallerTID CoLoadLibrary StgOpenStorageOnILockBytes HBITMAP_UserFree CoFileTimeNow CoSwitchCallContext CoRevokeClassObject

oleaut32

GetActiveObject VariantChangeType SafeArrayCreate VariantChangeTypeEx

Name

.text

Size

969KB

Virtual Size

969KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.o2xc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.56m4

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jc3

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dk5q

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jxnp

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eg8

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.arb06

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ