a263d4290cdddafc4afa37821fa772085aedd6c7833954bead77841669a275bc

Sharing

Copy URL Twitter E-mail

General

Target
a263d4290cdddafc4afa37821fa772085aedd6c7833954bead77841669a275bc
Size 238.0MB
Sample221202-efc1ksbc36
SHA256 18eac3b6b6bb0cfd1cc44e0570c8f03cb6425ef5e2b73ecf65184d1790144ed4
MD5 1d578f362ee1143bed422e0708e57c8d
SHA1 f8a0778a470daee0b529d90c6c12d07212340bb7
SHA512 0fe875f111b39a6f6fe49f9b72aa4202aecf4acc4304da33216384d2486da1e5314a5fe9ed72a477ea2dad185e0a0c881b221aacf661471f8a26cbf4b215768f
SSDEEP 49152:aYIbI0ONd9RusfA0tX/3R5NltjEfbFbmo:aYIbI0Ov9UCrxtW
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

a263d4290cdddafc4afa37821fa772085aedd6c7833954bead77841669a275bc

.exe 238.0MB

a263d4290cdddafc4afa37821fa772085aedd6c7833954bead77841669a275bc

IMPHASH b712a5f90a6ce7b235c98f66fad1bf0d
SHA256 18eac3b6b6bb0cfd1cc44e0570c8f03cb6425ef5e2b73ecf65184d1790144ed4
MD5 1d578f362ee1143bed422e0708e57c8d
SHA1 f8a0778a470daee0b529d90c6c12d07212340bb7
SHA512 0fe875f111b39a6f6fe49f9b72aa4202aecf4acc4304da33216384d2486da1e5314a5fe9ed72a477ea2dad185e0a0c881b221aacf661471f8a26cbf4b215768f
SSDEEP 49152:aYIbI0ONd9RusfA0tX/3R5NltjEfbFbmo:aYIbI0Ov9UCrxtW
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

215224

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetGetUniversalNameW

shell32

ShellExecuteExW

netapi32

NetWkstaGetInfo NetApiBufferFree

wsock32

WSAStartup gethostname inet_addr ioctlsocket htonl WSAGetLastError htons ntohs getservbyport recv bind socket getservbyname WSASetLastError closesocket gethostbyaddr gethostbyname send listen accept inet_ntoa

shlwapi

PathIsDirectoryW PathFindOnPathW

advapi32

ChangeServiceConfig2W RegQueryValueExW LsaAddAccountRights RegCreateKeyExW GetTokenInformation OpenServiceW LsaOpenPolicy LogonUserW StartServiceCtrlDispatcherW ReportEventW DeregisterEventSource RegCreateKeyW RegisterEventSourceW LsaFreeMemory RegSetValueExW RegCloseKey QueryServiceConfigW ConvertSidToStringSidW ControlService RegisterServiceCtrlHandlerW LsaNtStatusToWinError RegOpenKeyExW RegEnumValueW SetServiceStatus LsaClose QueryServiceStatus StartServiceW LookupAccountSidW OpenSCManagerW LookupAccountNameW RegDeleteKeyW CreateServiceW CloseServiceHandle OpenProcessToken LsaQueryInformationPolicy DeleteService RegQueryInfoKeyW

user32

GetWindowRect GetKeyState FindWindowW TranslateMessage GetForegroundWindow RegisterClassExW GetWindowPlacement SystemParametersInfoW PeekMessageW ShowWindow CreateWindowExW IsWindowVisible UpdateWindow DefWindowProcW GetWindowThreadProcessId DispatchMessageW GetSystemMetrics SetWindowPlacement DestroyWindow

crypt32

CryptMsgClose CryptDecodeObject CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam

wintrust

WinVerifyTrust

pdh

PdhOpenQueryW PdhCollectQueryData PdhGetFormattedCounterValue

kernel32

LCMapStringW SetHandleCount GetStartupInfoA CreateFileA WriteConsoleA GetConsoleOutputCP InitializeCriticalSectionAndSpinCount SetEnvironmentVariableA GetStringTypeW SetFilePointer SetEndOfFile GetProcessHeap GetCommandLineW GetTickCount LCMapStringA GetStringTypeA GetUserDefaultLCID GetDriveTypeA GetCurrentDirectoryA RtlUnwind GetModuleFileNameA HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapCreate TlsFree TlsSetValue TlsAlloc TlsGetValue GetOEMCP InterlockedIncrement GetCPInfo GetLocaleInfoA EnumSystemLocalesA IsValidLocale RaiseException CompareStringW HeapSize GetModuleHandleA CompareStringA GetLastError IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW MoveFileW GetFullPathNameW CreateMutexW PeekNamedPipe FreeLibrary GetEnvironmentStringsW WaitForSingleObject ConnectNamedPipe GetModuleHandleW CreateNamedPipeW WriteFile WideCharToMultiByte LoadLibraryW GetConsoleMode GetLocaleInfoW GetVersionExW SetConsoleMode TerminateProcess ReadFile GetSystemDirectoryA GetACP MultiByteToWideChar GetStdHandle SetLastError GetThreadLocale GetProcAddress LoadLibraryA Process32FirstW GetSystemInfo Process32NextW SetConsoleTitleW FreeEnvironmentStringsW CreateToolhelp32Snapshot ReleaseMutex CloseHandle GetEnvironmentVariableW lstrcmpA SetPriorityClass GetDriveTypeW AllocConsole CreateProcessW GetCurrentProcess QueryPerformanceCounter GenerateConsoleCtrlEvent OpenProcess Sleep GetConsoleWindow FormatMessageW GetExitCodeProcess FileTimeToSystemTime GetModuleFileNameW CreateFileW GetStartupInfoW FlushFileBuffers GetCurrentDirectoryW GetLocalTime ProcessIdToSessionId LocalAlloc SetConsoleCtrlHandler GlobalMemoryStatusEx CreatePipe QueryPerformanceFrequency GetCurrentThreadId DuplicateHandle FileTimeToLocalFileTime GetCurrentProcessId LocalFree lstrcpyW CreateThread ExpandEnvironmentStringsW WriteConsoleW lstrlenW IsValidCodePage HeapFree HeapAlloc FindClose FindFirstFileW SetEnvironmentVariableW SetCurrentDirectoryW GetTimeZoneInformation GetSystemTimeAsFileTime DeleteFileW GetConsoleCP ReadConsoleInputA ReadConsoleInputW EnterCriticalSection LeaveCriticalSection SetStdHandle GetFileType InterlockedDecrement ExitProcess