6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa

Sharing

Copy URL Twitter E-mail

General

Target
6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa
Size 5.2MB
Sample231122-p74mqace82
SHA256 6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa
MD5 1322ffff778520b34fafee4fb592d244
SHA1 3022b8358c0f25d8deb18fed0c85df0e4732bab8
SHA512 81a2d0166bd4d4069e764684444824906ae52ed7c369aa320648d5aeca69d36a98da1ddf275e5f672700741fceca627f3d15b1842d749a8009ae77d3275b46c1
SSDEEP 98304:+uq1zcBTuStAeThPGMhRiCu/CVUdVEy9qMBNP/qxct8qdvZOMA4bj:kc3AR4UdVEy9qMBNLtNvZOMA4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa

File Explorer

6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa

.exe 5.2MB

6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa

IMPHASH 78087433c8009c34c38afd5dfe521685
SHA256 6004c8245a81d7492925cd22c6ac0571595f47ce8392ac391fc9aa132d8679aa
MD5 1322ffff778520b34fafee4fb592d244
SHA1 3022b8358c0f25d8deb18fed0c85df0e4732bab8
SHA512 81a2d0166bd4d4069e764684444824906ae52ed7c369aa320648d5aeca69d36a98da1ddf275e5f672700741fceca627f3d15b1842d749a8009ae77d3275b46c1
SSDEEP 98304:+uq1zcBTuStAeThPGMhRiCu/CVUdVEy9qMBNP/qxct8qdvZOMA4bj:kc3AR4UdVEy9qMBNLtNvZOMA4
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

396507

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstChangeNotificationW CompareFileTime GetFileInformationByHandle RtlCaptureStackBackTrace GetDriveTypeW WritePrivateProfileStringW lstrcmpiW LoadLibraryExW ExitThread GetCommandLineW VerifyVersionInfoW VerSetConditionMask CreateThread GetCurrentThreadId InitializeCriticalSectionEx RaiseException DecodePointer lstrcpynW GetLocalTime WaitForMultipleObjects Sleep CreateEventW WaitForSingleObject SetEvent K32GetProcessImageFileNameW K32GetModuleFileNameExW LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary IsWow64Process GetTickCount OpenProcess lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW WriteConsoleW SetFilePointerEx GetCurrentProcess ReadFile QueryDosDeviceW GetLogicalDriveStringsW GetFileSize CreateFileW MultiByteToWideChar WideCharToMultiByte DeleteCriticalSection GetModuleFileNameW CreateMutexW LeaveCriticalSection EnterCriticalSection InitializeCriticalSection MoveFileExW MoveFileW lstrlenW FindResourceW SizeofResource FindCloseChangeNotification LockResource LoadResource CreateDirectoryW GetWindowsDirectoryW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError GetTempPathW SetFileAttributesW RemoveDirectoryW ReadConsoleW SetStdHandle SetConsoleCtrlHandler SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetConsoleMode GetConsoleCP GetTimeZoneInformation GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType GetStdHandle GetModuleFileNameA GetModuleHandleExW RtlUnwind WaitForMultipleObjectsEx CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore DuplicateHandle SetProcessAffinityMask VirtualProtect GetFullPathNameW GetFileAttributesW FindNextFileW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes GetCurrentThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask FindResourceExW SearchPathW GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait ResumeThread GetVersion FindFirstFileW FindClose DeleteFileW CloseHandle WriteFile GetFileAttributesExW SetFilePointer CreateFileMappingW MapViewOfFile UnmapViewOfFile GetLongPathNameW GetCurrentProcessId TerminateProcess GetExitCodeProcess CopyFileW GetShortPathNameW OutputDebugStringA OutputDebugStringW GetFileSizeEx ResetEvent GetSystemInfo GetTempFileNameW LocalFree FormatMessageW GetEnvironmentVariableW GetVersionExW GetDiskFreeSpaceExW GetSystemDirectoryW LocalAlloc IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA TryEnterCriticalSection QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime FlushFileBuffers GlobalAlloc GlobalLock GlobalUnlock GlobalFree UnhandledExceptionFilter SetUnhandledExceptionFilter WaitForSingleObjectEx GetStartupInfoW lstrcpyW SetCurrentDirectoryW GetCurrentDirectoryW MulDiv GetACP IsBadReadPtr ExitProcess FreeResource lstrcmpW FileTimeToLocalFileTime GetFileTime LocalFileTimeToFileTime SetEndOfFile SetFileTime GetSystemTime FileTimeToDosDateTime DosDateTimeToFileTime SystemTimeToFileTime

user32

CopyRect SendMessageTimeoutW wsprintfW MessageBoxW UnionRect OffsetRect EqualRect DestroyCursor DrawFocusRect MoveWindow IsChild IsZoomed GetKeyState GetUpdateRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos IntersectRect IsRectEmpty GetClassNameW PostQuitMessage RegisterClassW EnableWindow GetMenu SetPropW GetPropW AdjustWindowRectEx wvsprintfW InflateRect RemovePropW SetWindowRgn MonitorFromPoint CopyImage CharPrevW SetRect DestroyIcon DrawIconEx GetIconInfo GetMessagePos AttachThreadInput HideCaret ShowCaret ClientToScreen GetSysColor GetWindowDC CreateAcceleratorTableW InvalidateRgn IsWindowEnabled SetForegroundWindow GetSystemMetrics GetActiveWindow DialogBoxParamW IsIconic IsWindowVisible FindWindowW CharNextW BringWindowToTop PeekMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW FillRect ScreenToClient GetWindowTextLengthW GetWindowTextW SetWindowTextW DrawTextW GetAsyncKeyState GetFocus UpdateLayeredWindow ShowWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW GetForegroundWindow DefWindowProcW DestroyWindow GetMonitorInfoW MonitorFromWindow IsDialogMessageW LoadCursorW GetWindow GetParent SetWindowLongW GetWindowLongW PtInRect MapWindowPoints SetCursor GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture SetFocus EndDialog SystemParametersInfoW SetWindowPos SendMessageW GetShellWindow LoadStringW GetWindowThreadProcessId FindWindowExW PostMessageW KillTimer SetTimer LoadImageW GetDlgCtrlID CallWindowProcW

gdi32

GetTextExtentPoint32W ExtSelectClipRgn StretchBlt SetStretchBltMode SetDIBColorTable TextOutW ExtTextOutW GdiFlush GetTextColor CreateDCW GetDIBits SetDIBitsToDevice GetClipBox GetCharABCWidthsW CombineRgn GetDeviceCaps CreateRoundRectRgn GetTextMetricsW Rectangle CreatePen CreateFontIndirectW OffsetViewportOrgEx RectVisible EnumFontFamiliesW BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject SetViewportOrgEx CreateFontW CreateRectRgnIndirect CreateSolidBrush GetStockObject RestoreDC SaveDC SelectClipRgn SetBkColor SetBkMode SetTextColor CreateDIBSection GetObjectW SetWindowOrgEx

advapi32

SetNamedSecurityInfoW AllocateAndInitializeSid CheckTokenMembership FreeSid DeleteAce EqualSid LookupAccountSidW LookupAccountNameW SetEntriesInAclW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegEnumValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken BuildExplicitAccessWithNameW GetTrusteeNameW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetKeyParam CryptGenRandom CryptImportKey CryptEncrypt CryptDecrypt CryptContextAddRef CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCreateKeyW GetTokenInformation GetExplicitEntriesFromAclW GetNamedSecurityInfoW GetUserNameW

shell32

ShellExecuteExW SHFileOperationW ord165 ShellExecuteW SHCreateDirectoryExW SHGetSpecialFolderPathW SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW SHChangeNotify

ole32

OleRun CoCreateGuid StringFromGUID2 CLSIDFromString OleLockRunning CreateStreamOnHGlobal CLSIDFromProgID CoUninitialize CoTaskMemFree CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemRealloc

oleaut32

VarUI4FromStr VariantCopy SafeArrayPutElement SafeArrayCreate SysAllocStringLen CreateErrorInfo SetErrorInfo VarBstrCmp VariantClear SysFreeString SysStringByteLen VariantChangeType GetErrorInfo VariantInit SysStringLen SysAllocStringByteLen SysAllocString

shlwapi

AssocQueryStringW wnsprintfW PathIsPrefixW SHSetValueW PathIsRootW SHAutoComplete StrCmpNIW StrTrimA StrStrIA StrCmpIW SHSetValueA PathIsRelativeW SHGetValueW PathFindFileNameA PathAppendW PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameW PathCompactPathW PathRemoveFileSpecW PathIsDirectoryW StrStrIW

comctl32

ord17 ImageList_DrawEx _TrackMouseEvent InitCommonControlsEx ImageList_GetIconSize

gdiplus

GdipImageGetFrameDimensionsList GdipGetPropertyItem GdipImageSelectActiveFrame GdipDrawImageRectI GdipGetImagePixelFormat GdipImageGetFrameCount GdiplusStartup GdipLoadImageFromFileICM GdipLoadImageFromFile GdipLoadImageFromStreamICM GdipGetPropertyItemSize GdipImageGetFrameDimensionsCount GdipAlloc GdipFree GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipGetImageHeight GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipDrawRectangleI GdipFillRectangleI GdipDrawImagePointRectI GdipDrawImageRectRect GdipDrawImageRectRectI GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipSetPenMode GdipSetPenDashStyle GdipSetSmoothingMode GdipDrawLineI GdipDrawPath GdipFillEllipseI GdipClosePathFigure GdipCreateTexture GdipSaveImageToFile GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCloneBitmapAreaI GdipBitmapLockBits GdipBitmapUnlockBits GdipSetInterpolationMode GdipGraphicsClear GdipFillPath GdipDrawImagePointsI GdipGetImageEncodersSize GdipGetImageEncoders GdipAddPathArc GdipDrawEllipseI GdiplusShutdown

psapi

GetModuleFileNameExW GetProcessImageFileNameW EnumProcesses

iphlpapi

GetAdaptersInfo

wininet

InternetGetConnectedState

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

setupapi

SetupIterateCabinetW

crypt32

CryptStringToBinaryW CryptBinaryToStringA CryptBinaryToStringW CryptStringToBinaryA

msimg32

GradientFill AlphaBlend

generic

count=9, id=260, version=27045,

count=20, id=261, version=27045,

count=2, id=260, version=27034,

count=36, id=259, version=24610,

count=185, id=261, version=24610,

count=29, id=260, version=24610,

count=65, id=261, version=27048,

count=8, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=3, id=199, version=41118,

count=27, id=259, version=26706,

count=16, id=261, productName=VS2017 v15.8.0 build 26726, version=26726,

count=1, id=263, version=24610,

count=5, id=261, version=27032,

count=38, id=260, version=26706,

count=131, id=261, version=26706,

count=1, id=260, version=27049,

count=15, id=262, version=24610,

count=37, id=257, version=24610,

count=578, id=1, productName=Unmarked objects,

count=67, id=261, version=27049,

count=1, id=256, version=27049,

count=1, id=255, version=27049,

count=1, id=151,

count=1, id=258, version=27049,