1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71

Sharing

Copy URL Twitter E-mail

General

Target
1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71
Size 720KB
Sample231113-p57xcsdb96
SHA256 1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71
MD5 d6dfe7c2d497e42a2a623909428afa18
SHA1 44751a0b81b3a69c02db5be04ad6756628f0a905
SHA512 54f20f42e680f0ae95cd514d5d7560f1aeb00f99c2ed2b7898809ff1f361be646f73f555e7692e7c395e7227d501e73fd29a1bab2f50b7a9fa929aed03599a76
SSDEEP 12288:l+MbFpyhfFNZ2kW32pVqv+dEAy8v4m7e0Y5tK9n1o7X/NWWK2QwXL9s0:HFpyh1BC3Qe0g4n+v4XCL60
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71

File Explorer

1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71

.dll 720KB

1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71

IMPHASH 0b921e0676abfa526f6828ea6e1f027c
SHA256 1129d65129af4c82257509198fa9f809392f8d7c4d676f7fd5026848c3c8fa71
MD5 d6dfe7c2d497e42a2a623909428afa18
SHA1 44751a0b81b3a69c02db5be04ad6756628f0a905
SHA512 54f20f42e680f0ae95cd514d5d7560f1aeb00f99c2ed2b7898809ff1f361be646f73f555e7692e7c395e7227d501e73fd29a1bab2f50b7a9fa929aed03599a76
SSDEEP 12288:l+MbFpyhfFNZ2kW32pVqv+dEAy8v4m7e0Y5tK9n1o7X/NWWK2QwXL9s0:HFpyh1BC3Qe0g4n+v4XCL60
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

302916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

ResumeThread FindClose FindFirstFileW FindNextFileW CreateProcessW LoadLibraryExW lstrcmpiW lstrlenA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FreeConsole GetCurrentThreadId CreateFileW FlushFileBuffers GetFileSize ReadFile WriteFile GetPrivateProfileStringW DeviceIoControl SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CreateWaitableTimerW CancelWaitableTimer SetWaitableTimer CreateEventW SetEvent LocalFileTimeToFileTime Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcpynW lstrcmpW OpenProcess ProcessIdToSessionId WaitForSingleObjectEx WaitForSingleObject PostQueuedCompletionStatus GetQueuedCompletionStatus CreateIoCompletionPort CloseHandle LocalFree LocalAlloc GetTickCount Sleep WideCharToMultiByte MultiByteToWideChar SystemTimeToFileTime WritePrivateProfileStringW GetPrivateProfileIntW lstrlenW LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetTimeFormatW GetDateFormatW GetStdHandle GetACP GetModuleFileNameA ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleCP SetFilePointerEx SetEndOfFile GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread InterlockedFlushSList RtlUnwind InterlockedDecrement InterlockedIncrement OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetVersionExW InitializeSListHead GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetLocalTime GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentProcessId GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection TerminateProcess InitializeCriticalSection GetProcessHeap HeapSize CreateFileA GetSystemDirectoryW lstrcmpiA lstrcmpA GetSystemWindowsDirectoryW FreeResource InterlockedCompareExchange WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException FindFirstFileExA ReadConsoleW DecodePointer OutputDebugStringW GetStringTypeW FormatMessageW EncodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent ReleaseMutex CreateMutexW DeleteFileW CopyFileW GetFileSizeEx FindNextFileA IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW

user32

wsprintfW

advapi32

QueryServiceStatusEx CloseServiceHandle ControlService CreateServiceW DeleteService LockServiceDatabase OpenSCManagerW RegGetValueW RegCreateKeyExW RegEnumKeyExW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA OpenServiceW ConvertSidToStringSidW GetUserNameW LookupAccountNameW RevertToSelf ImpersonateLoggedOnUser SetServiceStatus RegisterServiceCtrlHandlerExW RegCreateKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW UnlockServiceDatabase StartServiceW QueryServiceConfigW QueryServiceStatus QueryServiceLockStatusW ChangeServiceConfigW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoCreateGuid CreateStreamOnHGlobal

shlwapi

SHGetValueW PathIsRelativeW PathFindExtensionW StrCmpIW PathIsDirectoryW PathCombineW PathFileExistsW PathAppendW wvnsprintfW StrToInt64ExW StrStrIA SHGetValueA SHSetValueA StrCmpNIW wnsprintfW StrTrimA StrStrIW PathFindFileNameW PathRemoveFileSpecW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ws2_32

socket shutdown send recv listen htons htonl connect closesocket bind accept WSAStartup WSAGetLastError WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents WSACleanup

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winhttp

WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpenRequest WinHttpCloseHandle WinHttpOpen WinHttpSetCredentials WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpSendRequest WinHttpConnect WinHttpReadData

wininet

InternetGetConnectedState

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

generic

count=1, id=262, version=24610,

count=2, id=264, version=27048,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=18, id=259, version=24610,

count=170, id=261, version=24610,

count=24, id=260, version=24610,

count=25, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=21, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=6, id=261, version=27032,

count=4, id=261, version=27031,

count=63, id=261, version=26706,

count=33, id=260, version=26706,

count=33, id=257, version=24610,

count=300, id=1, productName=Unmarked objects,

count=17, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=151,

count=1, id=258, version=27048,