9c5cc5883ce4bf3c2d36037f0e3c691b

Sharing

Copy URL Twitter E-mail

General

Target
9c5cc5883ce4bf3c2d36037f0e3c691b
Size 1.4MB
Sample231222-qgk85afadj
SHA256 1329bfbf32fe56f59b4883cf562892a9956b415d4f5f7c621662783f9c6e53ee
MD5 9c5cc5883ce4bf3c2d36037f0e3c691b
SHA1 e152fcc7789ca57befa594b52cda8de4295ef696
SHA512 5c07d69619613e06fede65d025ba42da693aabda6e80a7b8a8e3aed632eea0ea000a7f7b2f508773e9f29c479bc19e65abf93932750779dfc3cfdb9d9b0d6e09
SSDEEP 24576:lFxQfu6mmGNLpFAKhg+xtugc1fD5a0gr+TUYeHF0USFr9znP5p:lPQfr0Zxu80grwUYelc9znxp
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c5cc5883ce4bf3c2d36037f0e3c691b

File Explorer

9c5cc5883ce4bf3c2d36037f0e3c691b

.exe 1.4MB

9c5cc5883ce4bf3c2d36037f0e3c691b

IMPHASH d7e38be4913fad3d7283aa01e3ef4168
SHA256 1329bfbf32fe56f59b4883cf562892a9956b415d4f5f7c621662783f9c6e53ee
MD5 9c5cc5883ce4bf3c2d36037f0e3c691b
SHA1 e152fcc7789ca57befa594b52cda8de4295ef696
SHA512 5c07d69619613e06fede65d025ba42da693aabda6e80a7b8a8e3aed632eea0ea000a7f7b2f508773e9f29c479bc19e65abf93932750779dfc3cfdb9d9b0d6e09
SSDEEP 24576:lFxQfu6mmGNLpFAKhg+xtugc1fD5a0gr+TUYeHF0USFr9znP5p:lPQfr0Zxu80grwUYelc9znxp
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195187

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LockResource LoadResource SizeofResource FindResourceW CreateThread InterlockedIncrement InterlockedDecrement lstrcmpiW GetCommandLineW GetDiskFreeSpaceExW OutputDebugStringW WaitForMultipleObjects GetStdHandle GetFileInformationByHandle GetSystemInfo GetCurrentProcess GetProcessAffinityMask GlobalMemoryStatus FileTimeToSystemTime FileTimeToLocalFileTime SetFilePointer SetEndOfFile ReadFile WriteFile GetFileSize FindNextFileW FindFirstFileW GetModuleHandleA GetLogicalDriveStringsW FindClose MoveFileExW MoveFileW DeleteFileW GetFileAttributesW SetFileAttributesW CreateFileW RemoveDirectoryW CreateDirectoryW GetCurrentDirectoryW GetWindowsDirectoryW GetTempPathW SetFileTime SetLastError GetCurrentThreadId GetCurrentProcessId FormatMessageW LocalFree GetModuleFileNameW LoadLibraryW FreeLibrary WideCharToMultiByte MultiByteToWideChar CreateEventW CloseHandle WaitForSingleObject ResetEvent SetEvent InitializeCriticalSection GetSystemDirectoryW LoadLibraryExW lstrlenW lstrcatW GetVersionExW VirtualFree VirtualAlloc GetModuleHandleW GetProcAddress Sleep CompareFileTime GetTickCount DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection WriteConsoleW ReadConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW GetLastError RaiseException DecodePointer GetTimeZoneInformation GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead GetACP VerSetConditionMask VerifyVersionInfoW FreeResource ExitProcess MulDiv OpenProcess GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetFileType DuplicateHandle SystemTimeToFileTime DosDateTimeToFileTime GetLocalTime CreateProcessW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryDosDeviceW RtlUnwind ExitThread FreeLibraryAndExitThread GetModuleHandleExW HeapAlloc HeapReAlloc HeapFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx HeapSize GetProcessHeap

user32

GetClientRect GetParent GetWindow LoadCursorW LoadImageW MonitorFromWindow GetMonitorInfoW SetCursor InflateRect UnionRect OffsetRect UpdateLayeredWindow SetCapture GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect GetCursorPos MapWindowPoints IsRectEmpty PtInRect UpdateWindow IntersectRect IsIconic SetWindowRgn CharPrevW DrawTextW FillRect SetRect GetDesktopWindow GetWindowRgn OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CreateCaret HideCaret ShowCaret GetPropW GetCaretPos ClientToScreen GetSysColor CreateAcceleratorTableW SetPropW DestroyIcon GetIconInfo SetForegroundWindow GetSystemMetrics MsgWaitForMultipleObjects BringWindowToTop PostMessageW IsWindowVisible SetWindowPos DestroyWindow IsWindow GetClassInfoExW RegisterClassExW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW CharNextW PostQuitMessage KillTimer SetTimer ReleaseCapture IsZoomed MessageBoxW GetWindowTextLengthW GetWindowTextW LoadStringW wsprintfW CreateWindowExW CallWindowProcW SetWindowLongW GetWindowLongW CharUpperW ScreenToClient GetWindowRect SetWindowTextW InvalidateRect EnableWindow GetKeyState GetFocus SetFocus MoveWindow TranslateMessage GetMessageW InvalidateRgn SendMessageW ShowWindow SetCaretPos

gdi32

CreateDIBSection GetObjectW SetWindowOrgEx CreateDCW GetDIBits DeleteObject GetTextMetricsW CreateRoundRectRgn GetObjectA CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode StretchBlt SetStretchBltMode SetTextColor MoveToEx TextOutW GetDeviceCaps CreateRectRgn PtInRegion SelectObject SaveDC RestoreDC Rectangle GetStockObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateICW

advapi32

RegQueryValueExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyW RegEnumKeyW DuplicateTokenEx CreateProcessAsUserW LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetTokenInformation GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW ord75 ShellExecuteW SHGetFileInfoW SHGetPathFromIDListW SHBrowseForFolderW

ole32

CoUninitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree OleInitialize CoInitialize CoCreateInstance RegisterDragDrop RevokeDragDrop CreateStreamOnHGlobal OleLockRunning CLSIDFromProgID CLSIDFromString

oleaut32

VariantInit SysFreeString VarUI4FromStr SysStringLen SysAllocString SysAllocStringLen VariantClear

gdiplus

GdipCloneImage GdipDisposeImage GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipSetTextRenderingHint GdipCreateFontFromDC GdipCreateFontFromLogfontA GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCreatePen1 GdipDeletePen GdipFree GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFont GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdiplusStartup GdiplusShutdown GdipCreateLineBrushI GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipImageGetFrameDimensionsCount GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipDrawArcI GdipCreateBitmapFromHBITMAP GdipAlloc GdipSetPenMode GdipCreateHBITMAPFromBitmap

shlwapi

PathFileExistsW ord219 PathRemoveFileSpecW

comctl32

_TrackMouseEvent ord17

psapi

GetModuleFileNameExW EnumProcesses

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

607KB

Virtual Size

607KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

171KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

550KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=24, id=241, version=40116,

count=180, id=243, version=40116,

count=32, id=242, version=40116,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=261, version=23013,

count=1, id=199, version=41118,

count=26, id=259, version=24123,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=65, id=261, version=24123,

count=36, id=260, version=24123,

count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=31, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=478, id=1, productName=Unmarked objects,

count=21, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=168, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,