e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224

Sharing

Copy URL Twitter E-mail

General

Target
e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224
Size 70KB
Sample231010-1mr9qsdd6v
SHA256 e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224
MD5 fa6bb9d7140acb30915bb34ed9311f47
SHA1 509ef04131897631b3c5c09883f80ce3473accb8
SHA512 49124435064d04865ae118885a64047e644e2f6558353b7c45460ed2298e7a7fabe7319992442f5ee4a7a3be8bc4e73657a96d5412b6990e0141b20795fb7aa0
SSDEEP 1536:1eeJBxp1/+we0Ss1UsoILrAgI9uErsjkIyeaKbA5ebmz0R8rT4bk:jfT1/+wXWxILEuEUkIxRb4ebmwR8ru
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224

File Explorer

e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224

.dll 70KB

e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224

IMPHASH b6290f31acc8212c6740de0f4e88b3b3
SHA256 e427e6d71f03e8a3238d19dbf49490b39c0805e498737e0d1aa353c9dce41224
MD5 fa6bb9d7140acb30915bb34ed9311f47
SHA1 509ef04131897631b3c5c09883f80ce3473accb8
SHA512 49124435064d04865ae118885a64047e644e2f6558353b7c45460ed2298e7a7fabe7319992442f5ee4a7a3be8bc4e73657a96d5412b6990e0141b20795fb7aa0
SSDEEP 1536:1eeJBxp1/+we0Ss1UsoILrAgI9uErsjkIyeaKbA5ebmz0R8rT4bk:jfT1/+wXWxILEuEUkIxRb4ebmwR8ru
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess GlobalLock GlobalUnlock FreeLibraryAndExitThread GetModuleHandleW GetCurrentThreadId GetCurrentProcessId GetModuleFileNameW GetCurrentThread DisableThreadLibraryCalls GetACP SetConsoleCP SetConsoleOutputCP GetTickCount QueryPerformanceCounter Sleep LocalFree FormatMessageW GetLastError CreateIoCompletionPort GetQueuedCompletionStatus CreateThread VirtualProtect EnterCriticalSection VirtualQueryEx VirtualProtectEx VirtualAlloc FlushInstructionCache SetThreadContext GetThreadContext ResumeThread SuspendThread VirtualQuery VirtualFree SetLastError InitializeSListHead GetSystemTimeAsFileTime LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent CloseHandle

user32

SendMessageTimeoutW SetWindowTextA GetWindowLongW EnumWindows GetWindowThreadProcessId GetWindow IsWindowVisible CallWindowProcW SetWindowLongW SendMessageW CloseClipboard GetClipboardData OpenClipboard PostMessageW GetKeyState

msvcp140

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?id@?$ctype@_W@std@@2V0locale@2@A ??Bid@locale@std@@QAEIXZ ?widen@?$ctype@_W@std@@QBE_WD@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z _Cnd_destroy_in_situ _Cnd_init_in_situ _Mtx_destroy_in_situ _Mtx_init_in_situ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Mtx_unlock _Mtx_lock ?_Throw_C_error@std@@YAXH@Z _Cnd_signal _Thrd_join _Thrd_id ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?_Xout_of_range@std@@YAXPBD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z

msvcp140_1

_Aligned_get_default_resource

ntdll

NtClose NtTerminateProcess

ws2_32

WSASend htons connect WSACleanup WSAGetLastError WSASocketW InetPtonW WSAConnect WSAStartup

winmm

timeGetTime

vcruntime140

memcpy _except_handler4_common __std_type_info_destroy_list _CxxThrowException memset memmove __std_exception_destroy __std_exception_copy __CxxFrameHandler3 memchr

api-ms-win-crt-runtime-l1-1-0

terminate _invalid_parameter_noinfo_noreturn _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _beginthreadex

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s __stdio_common_vsnprintf_s

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc

api-ms-win-crt-string-l1-1-0

strcmp

Name

.text

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ