03e136599f83585f43805f3d41c24120

Sharing

Copy URL Twitter E-mail

General

Target
03e136599f83585f43805f3d41c24120
Size 156KB
Sample231229-ztscmschf4
SHA256 dd87574865a462c48b820dccf66903be0df4fb891fa269cc15e416580d2ca063
MD5 03e136599f83585f43805f3d41c24120
SHA1 f1891ad0f67345d32a38a888b878b03cec999f0c
SHA512 353f899e0e9b7966126256fdf1bcacf2e06815f104418645167502668603fe8f045c7e9032949cbf09c0e3f517546935b0a1f53403c33c56fb9933711b24a7d7
SSDEEP 3072:Wo5FL9T+wJku2IbiJ7mj7C2wqKfrf+Ol0stDfe5T:1Agku2Ixu3BeR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03e136599f83585f43805f3d41c24120

File Explorer

03e136599f83585f43805f3d41c24120

.dll 156KB

03e136599f83585f43805f3d41c24120

IMPHASH 747a06176ca56bad52554f340c22bc19
SHA256 dd87574865a462c48b820dccf66903be0df4fb891fa269cc15e416580d2ca063
MD5 03e136599f83585f43805f3d41c24120
SHA1 f1891ad0f67345d32a38a888b878b03cec999f0c
SHA512 353f899e0e9b7966126256fdf1bcacf2e06815f104418645167502668603fe8f045c7e9032949cbf09c0e3f517546935b0a1f53403c33c56fb9933711b24a7d7
SSDEEP 3072:Wo5FL9T+wJku2IbiJ7mj7C2wqKfrf+Ol0stDfe5T:1Agku2Ixu3BeR
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc71

ord1084 ord1098 ord371 ord1175 ord762 ord293 ord577 ord764 ord266 ord265 ord1917 ord1187 ord1191

msvcr71

__CppXcptFilter _adjust_fdiv _initterm _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ __security_error_handler memset strncpy realloc srand isspace rand strchr strpbrk time atoi sprintf _CxxThrowException __CxxFrameHandler memmove _snprintf printf strstr _access _stricmp _write _close _lseek _open free malloc _resetstkoflw _except_handler3 _vscwprintf vswprintf wcslen

kernel32

HeapDestroy HeapReAlloc GetWindowsDirectoryA DeleteFileA HeapFree GetProcessHeap InterlockedIncrement InterlockedDecrement MulDiv FlushInstructionCache GetCurrentProcess HeapAlloc GlobalUnlock GlobalLock GlobalAlloc HeapSize CreateProcessA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter ExitProcess LocalFree LoadLibraryA GetCurrentThreadId IsDBCSLeadByte lstrcpynA LoadLibraryExA FreeLibrary GetModuleHandleA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA MultiByteToWideChar WideCharToMultiByte RaiseException GetLastError InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA lstrcmpiA lstrlenW lstrlenA EnterCriticalSection LeaveCriticalSection GetPrivateProfileStringA CloseHandle Process32Next Process32First CreateToolhelp32Snapshot TerminateProcess GetPriorityClass OpenProcess OutputDebugStringW GetTickCount WritePrivateProfileStringA Sleep CreateThread GetModuleFileNameA Thread32Next Thread32First GetProcessId lstrcmpA

user32

ShowWindow RegisterClassA LoadIconA MessageBoxA GetWindowThreadProcessId PeekMessageA GetWindowTextA SetWindowTextA GetClassInfoExA LoadCursorA wsprintfA RegisterClassExA CreateAcceleratorTableA UpdateWindow GetParent GetClassNameA PostQuitMessage DestroyWindow RedrawWindow DestroyAcceleratorTable GetDlgItem SetFocus GetFocus IsChild GetWindow BeginPaint EndPaint CallWindowProcA GetMessageA TranslateMessage CharNextA GetWindowTextLengthA GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetClientRect FillRect SetWindowPos RegisterWindowMessageA SetCapture ReleaseCapture GetSysColor DefWindowProcA SendMessageA CreateWindowExA SetWindowLongA UnhookWindowsHookEx SetWindowsHookExA CallNextHookEx IsWindow GetWindowLongA UnregisterClassA DispatchMessageA

gdi32

CreateSolidBrush GetStockObject GetObjectA GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC DeleteObject SelectObject

advapi32

RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegDeleteKeyA RegCloseKey

shell32

ShellExecuteA

shlwapi

PathFileExistsA

ole32

OleUninitialize OleInitialize CoTaskMemRealloc CLSIDFromString CLSIDFromProgID CoGetClassObject CreateStreamOnHGlobal OleLockRunning CoTaskMemAlloc StringFromGUID2 CoInitialize CoCreateInstance CoTaskMemFree

oleaut32

VarUI4FromStr LoadTypeLi SysFreeString VariantClear VariantCopy VariantChangeType VariantInit SysAllocStringLen SysAllocString SysStringLen SysStringByteLen OleCreateFontIndirect LoadRegTypeLi

psapi

GetModuleFileNameExA

Name

.text

Size

100KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

HookData

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

03e136599f83585f43805f3d41c24120

mfc71

msvcr71

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

oleaut32

psapi

generic