68d191d0cff5def467f12fd88c106d4bd50de1df13cdc17a9767b6004aa0a706

Sharing

Copy URL Twitter E-mail

General

Target
68d191d0cff5def467f12fd88c106d4bd50de1df13cdc17a9767b6004aa0a706
Size 60KB
Sample221129-me2xbaac83
SHA256 68d191d0cff5def467f12fd88c106d4bd50de1df13cdc17a9767b6004aa0a706
MD5 075d11a784a94b2a1c32e74286e70b3c
SHA1 bbba5adf38f5143942640955b75740d3a5d47569
SHA512 03f7ee4fdf97b83e4218344c88d7c0eea163bb63e9cbdc37078ea3b68f993e0db1810c481156eb76d6cc67b969233b52ff3555ba6fb26fc3f597f6d8760f9303
SSDEEP 1536:WIcb1UOYHAKlPaF5YsaWPFC45j+1PeFJClZpxcaO1Rjvo/HjdDh7:LhBcFmsPPMcj+1PeFJ2O1Nwf597
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

68d191d0cff5def467f12fd88c106d4bd50de1df13cdc17a9767b6004aa0a706

.dll 60KB

68d191d0cff5def467f12fd88c106d4bd50de1df13cdc17a9767b6004aa0a706

IMPHASH 20a921d000026d36c1772acb1aeb6a03
SHA256 68d191d0cff5def467f12fd88c106d4bd50de1df13cdc17a9767b6004aa0a706
MD5 075d11a784a94b2a1c32e74286e70b3c
SHA1 bbba5adf38f5143942640955b75740d3a5d47569
SHA512 03f7ee4fdf97b83e4218344c88d7c0eea163bb63e9cbdc37078ea3b68f993e0db1810c481156eb76d6cc67b969233b52ff3555ba6fb26fc3f597f6d8760f9303
SSDEEP 1536:WIcb1UOYHAKlPaF5YsaWPFC45j+1PeFJClZpxcaO1Rjvo/HjdDh7:LhBcFmsPPMcj+1PeFJ2O1Nwf597
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

42666

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

connect htons WSACleanup select WSAGetLastError shutdown __WSAFDIsSet inet_addr sendto WSAStartup ioctlsocket recv gethostbyname send socket closesocket

psapi

GetModuleBaseNameA EnumProcessModules EnumProcesses

crypt32

CryptBinaryToStringA CryptStringToBinaryA

urlmon

ObtainUserAgentString

kernel32

GetProcAddress GetTempFileNameA LoadLibraryA DeleteCriticalSection GetVersionExA CloseHandle GetTempPathA HeapReAlloc HeapAlloc HeapFree GetProcessHeap SetEvent Sleep CreateEventA ResetEvent GetModuleFileNameA VirtualProtect CreateThread FreeLibrary lstrcmpA MoveFileExA lstrcpynA GetFileAttributesA GetEnvironmentVariableA FindFirstFileA GetLastError CopyFileA SetFileAttributesA IsBadWritePtr OpenEventA FindNextFileA CreateRemoteThread GetLocalTime VirtualAllocEx GetCurrentProcessId WriteProcessMemory WaitNamedPipeA ConnectNamedPipe ReadFile GetOverlappedResult DisconnectNamedPipe CreateNamedPipeA SetNamedPipeHandleState WaitForMultipleObjects CreateFileA lstrcpyA lstrcmpiA lstrcatA EnterCriticalSection LeaveCriticalSection lstrlenA CreateProcessA OpenProcess InitializeCriticalSection WriteFile FindClose WaitForSingleObject GetCurrentProcess GetModuleHandleA FlushInstructionCache CreateEventW GetComputerNameExA GetTickCount

advapi32

RegSetValueExA FreeSid AllocateAndInitializeSid RegCloseKey RegEnumKeyA RegCreateKeyExA RegQueryValueExA CryptHashData CryptDestroyHash RegOpenKeyA RegEnumValueA RegDeleteValueA RegQueryInfoKeyA CryptDecrypt CryptDestroyKey CryptGenKey RegCreateKeyA InitializeSecurityDescriptor CryptCreateHash CryptEncrypt CryptImportKey CryptReleaseContext CryptAcquireContextW CryptExportKey CryptGetHashParam CheckTokenMembership

dnsapi

DnsQuery_A DnsFree

wininet

InternetCloseHandle InternetOpenA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetCrackUrlA InternetConnectA HttpQueryInfoA InternetTimeFromSystemTimeA