ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d

Sharing

Copy URL Twitter E-mail

General

Target
ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d
Size 185KB
Sample231226-ln87baahd4
SHA256 ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d
MD5 037dd97523fe411a139a658cd02f286b
SHA1 33634bf79eb5c0de5c64bb975fee19c2d6a094d0
SHA512 39611e7576f4f1e4955a756dcfbd3a976161eb3430644ed11471ee77d5922b0d2e56b70405c93650297dec5c3deed14b687b87fede9ab86df68a819b641b33fb
SSDEEP 3072:NTQMNXO+rnSHSDjtockuJjhVCvTwiuLj2cAJyds2FvuXUa69XD:NLvrnSHIjPEBuvre2FuUaCT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d

File Explorer

ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d

.dll 185KB

ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d

IMPHASH a0612ae6c16558036c0a6a6d98fd3d9c
SHA256 ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d
MD5 037dd97523fe411a139a658cd02f286b
SHA1 33634bf79eb5c0de5c64bb975fee19c2d6a094d0
SHA512 39611e7576f4f1e4955a756dcfbd3a976161eb3430644ed11471ee77d5922b0d2e56b70405c93650297dec5c3deed14b687b87fede9ab86df68a819b641b33fb
SSDEEP 3072:NTQMNXO+rnSHSDjtockuJjhVCvTwiuLj2cAJyds2FvuXUa69XD:NLvrnSHIjPEBuvre2FuUaCT
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97605

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetSetOptionA HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestA HttpQueryInfoA InternetConnectA InternetCloseHandle InternetOpenA InternetCanonicalizeUrlA InternetReadFile InternetCrackUrlA

mfc140

ord1186 ord3230 ord4841 ord262 ord259 ord4656 ord13199 ord1693 ord13884 ord13200 ord2438 ord1529 ord1526 ord2387 ord2383 ord266 ord265 ord8429 ord6103 ord1468 ord8347 ord12190 ord10383 ord12869 ord12806 ord4580 ord7961 ord8285 ord5336 ord2484 ord12485 ord12484 ord14509 ord7886 ord14507 ord9353 ord4143 ord4082 ord12888 ord7905 ord2027 ord11928 ord11927 ord1657 ord12474 ord7964 ord14581 ord6322 ord14583 ord6324 ord14582 ord6323 ord993 ord6831 ord3844 ord5894 ord12182 ord8180 ord12194 ord12162 ord5228 ord5528 ord5739 ord8470 ord557 ord6156 ord12348 ord9305 ord5504 ord5742 ord5231 ord5390 ord5210 ord7687 ord7688 ord7677 ord5388 ord8182 ord10202 ord9166 ord1507 ord14518 ord12291 ord6724 ord2376 ord486 ord2397 ord1696 ord1044 ord310 ord300 ord316 ord5861 ord5095 ord1661 ord1509 ord2165 ord1184 ord6154 ord12542 ord1655 ord8468 ord555 ord1183 ord6153 ord12541 ord1654 ord8467 ord554 ord6569 ord1410 ord13197 ord13882 ord928 ord6777 ord8322 ord12863 ord14333 ord14328 ord14334 ord12826 ord4655 ord12528 ord5898 ord1692 ord305 ord3005 ord14238 ord8146 ord4315 ord1139 ord492 ord1180 ord14571 ord6150 ord12632 ord1651 ord8464 ord551 ord6566 ord1447 ord12584 ord13198 ord13883 ord974 ord4807 ord2992 ord2986 ord2381 ord14365 ord954 ord6475 ord1449 ord976 ord8718 ord12544 ord14380 ord3841 ord1510 ord325 ord1051 ord2359 ord2241 ord324 ord1050 ord2406 ord2409 ord2372 ord2408 ord485 ord2263 ord2370 ord2178 ord2294 ord8677

kernel32

LocalFree GetProcAddress lstrlenA DeleteCriticalSection WaitForSingleObject SetEvent InitializeCriticalSectionAndSpinCount TerminateThread OutputDebugStringW MultiByteToWideChar LeaveCriticalSection EnterCriticalSection InterlockedDecrement GetModuleFileNameA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent CreateEventW WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LocalAlloc LoadLibraryW GetModuleHandleW GetModuleFileNameW SetLastError OutputDebugStringA Sleep ResetEvent ResumeThread GetExitCodeThread RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DecodePointer WideCharToMultiByte GetModuleHandleA CreateMutexA FormatMessageA CloseHandle ReleaseMutex GetLastError

user32

PostMessageA UnregisterClassA wsprintfA

advapi32

CryptAcquireContextA CryptDeriveKey CryptDestroyKey CryptGetHashParam CryptEncrypt CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegOpenKeyExA RegQueryValueExA CryptReleaseContext

ole32

CoCreateInstance CoCreateGuid StringFromGUID2 CoInitialize OleRun

oleaut32

SysFreeString SysStringByteLen SysAllocStringByteLen VariantInit VariantClear VariantCopy VariantChangeType GetErrorInfo SetErrorInfo SysAllocString CreateErrorInfo

dalog

?storage@CDALog@@QAEXPBD00_N1@Z ??1CDALog@@QAE@XZ ??0CDALog@@QAE@XZ ?Write@CDALog@@QAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z ?Write@CDALog@@QAAXPBDZZ ??RCDALog@@QAEAAV0@W4Lvl@0@@Z

vcruntime140

memmove __std_type_info_destroy_list _except_handler4_common __vcrt_InitializeCriticalSectionEx __std_terminate memcmp strchr _CxxThrowException __CxxFrameHandler3 memset _purecall memcpy

api-ms-win-crt-string-l1-1-0

strcmp strcpy strncpy strlen strcat

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-multibyte-l1-1-0

_mbsnbcmp _mbschr _mbsrchr _mbscmp _mbsnbcpy

api-ms-win-crt-runtime-l1-1-0

_beginthread _endthread _errno _invalid_parameter_noinfo _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit terminate _initterm _initterm_e

api-ms-win-crt-heap-l1-1-0

malloc _recalloc free

api-ms-win-crt-utility-l1-1-0

ldiv

api-ms-win-crt-time-l1-1-0

_time64

?DASAbort@@YAXXZ ?DASAddIP@@YAHPAD00H@Z ?DASAddTS@@YAHPAUDAS_TSINFO@@@Z ?DASAddTSAccount@@YAHPBDPAUDAS_ACCOUNTINFO@@@Z ?DASAppInitState@@YAXW4AppInitState@@@Z ?DASChangePwd@@YAHPBDH@Z ?DASClearTDateSubTTMap@@YAHPBD@Z ?DASClearTSAccount@@YAHPBD@Z ?DASDefaultLogin@@YAHPBD@Z ?DASEncrypt@@YAHPBDPADH@Z ?DASFini@@YAXXZ ?DASFiniData@@YAXXZ ?DASGetDASInfo@@YAHPAPAEPAH@Z ?DASGetExtraValue@@YAHPBD0PADH@Z ?DASGetJDSInfo@@YAHPAE@Z ?DASGetLockCount@@YAHXZ ?DASGetLoginInfo@@YAHW4LoginInfoFlag@@PADH@Z ?DASGetLoginInfo@@YAHW4LoginInfoFlag@@PADHPBD@Z ?DASGetLoginInfoAuth@@YAHW4LoginInfoFlag@@PAPAEPAH@Z ?DASGetTORInfo@@YAHPAE@Z ?DASGetTradeExtraValue@@YAHPBD0PADH@Z ?DASGetUpdateInfo@@YAHPAVCUpItemVector@@@Z ?DASGetUserExtraValue@@YAHPBD0PADH@Z ?DASInit@@YAHPAUHINSTANCE__@@PBD1@Z ?DASInitData2@@YAHPBD0H0@Z ?DASInitData@@YAHPBD00H0@Z ?DASLastError@@YA?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@XZ ?DASLogin@@YAHPAUHWND__@@PBD11111PAVCStringArray@@@Z ?DASLogout@@YAXPAUHWND__@@@Z ?DASMessageCheck@@YAHXZ ?DASMessageConfirm@@YAHK@Z ?DASNotifyCallCheck@@YAHXZ ?DASProcessCmdLine@@YAHPBDPAH1@Z ?DASRegisterClassFactory@@YAHXZ ?DASServerGroupDefault@@YAHXZ ?DASServerGroupNext@@YAHPBD@Z ?DASSetAccTDate@@YAHPBDHPAUDAS_ACCTDATE@@@Z ?DASSetAccountHolding@@YAHPBD0W4DasAccType@@0@Z ?DASSetConfigInfoCallback@@YAXP6AHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV12@PAX@Z2@Z ?DASSetExtra@@YAHPBD@Z ?DASSetID2SubTT@@YAHPBDABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HH@Z ?DASSetLoginInfo@@YAHW4LoginInfoFlag@@PBD@Z ?DASSetNotify@@YAXPAUHWND__@@@Z ?DASSetSubTT2Session@@YAHPBDHH@Z ?DASSetSysMsgInfoCallback@@YAXP6AHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV12@PAX@Z2@Z ?DASSetTDate@@YAHPBDHPAUDAS_TDATE@@@Z ?DASSetTSStatus@@YAHPBDH@Z ?DASSetTradeExtra@@YAHPBD@Z ?DASSetUserExtra@@YAHPBD@Z ?DASSetVersionCheck@@YAXH@Z ?DASSetVersionInfoCallback@@YAXP6AHV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@AAV12@PAX@Z2@Z ?DASVersionCheck@@YAHXZ DASCreateApp DASReleaseApp

Name

.text

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ff4b5d9289d7cadc65aa8ee224942369d6e557d9ba593269cf221b79edbfc14d

wininet

mfc140

kernel32

user32

advapi32

ole32

oleaut32

dalog

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

generic