3d692c234b503c96e3dd7f8b668683ea

Sharing

Copy URL Twitter E-mail

General

Target
3d692c234b503c96e3dd7f8b668683ea
Size 105KB
Sample240101-vprhbseecp
SHA256 e142094fa6042a630eda80c92a9b4dcd28ae4c9d1591760989d2abbcb3811782
MD5 3d692c234b503c96e3dd7f8b668683ea
SHA1 6c708c3a6ab6cecec1cdd719c6210d00c214d008
SHA512 3ec0ce19b02a8331e6257e680426b9cf7c517b2254e583bcfe28bdb9e8ee3f63896708b31a72f3942dbccd21a8350220a617c9d7fbda0f164f9a6869617c9aeb
SSDEEP 3072:Jae3xnFUfcuhQoBknKXpvhdud5gWmrv8V:YIxnekKXpvhddrvW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d692c234b503c96e3dd7f8b668683ea

File Explorer

3d692c234b503c96e3dd7f8b668683ea

.dll 105KB

3d692c234b503c96e3dd7f8b668683ea

IMPHASH 9d63cf2cd56b9c70167934af1cc11db0
SHA256 e142094fa6042a630eda80c92a9b4dcd28ae4c9d1591760989d2abbcb3811782
MD5 3d692c234b503c96e3dd7f8b668683ea
SHA1 6c708c3a6ab6cecec1cdd719c6210d00c214d008
SHA512 3ec0ce19b02a8331e6257e680426b9cf7c517b2254e583bcfe28bdb9e8ee3f63896708b31a72f3942dbccd21a8350220a617c9d7fbda0f164f9a6869617c9aeb
SSDEEP 3072:Jae3xnFUfcuhQoBknKXpvhdud5gWmrv8V:YIxnekKXpvhddrvW
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ws2_32

inet_ntoa gethostbyname WSAStartup WSACleanup

rpcrt4

UuidToStringA UuidCreate

kernel32

SetUnhandledExceptionFilter CloseHandle GetFileSize CreateFileA LoadLibraryA VirtualAlloc IsBadCodePtr GetCurrentProcess GetProcAddress GetModuleHandleA lstrcpynA lstrlenA lstrcmpiA HeapAlloc GetCurrentThreadId HeapDestroy HeapCreate lstrcpyA lstrcmpA DeleteFileA lstrcatA GetWindowsDirectoryA WriteFile VirtualQuery GetTickCount GetVolumeInformationA WideCharToMultiByte GetVersionExA FreeLibrary FindClose FindFirstFileA MoveFileExA HeapReAlloc GetProcessHeap HeapFree GetLastError CreateMutexA IsBadReadPtr ReadFile MapViewOfFile CreateFileMappingA UnmapViewOfFile WaitForSingleObject Sleep ReleaseMutex TlsAlloc GlobalAlloc MultiByteToWideChar TlsSetValue TlsGetValue TerminateProcess CreateProcessA LocalFree EnterCriticalSection LeaveCriticalSection HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA DeleteCriticalSection GetStartupInfoA GetFileType SetHandleCount ExitProcess LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo InterlockedDecrement SetLastError InterlockedIncrement GetModuleHandleW GetStdHandle IsDebuggerPresent UnhandledExceptionFilter GetCommandLineA RtlUnwind RaiseException GetModuleFileNameA VirtualProtect GetLocaleInfoA GetStringTypeA WinExec DisableThreadLibraryCalls CreateThread GetCurrentProcessId TerminateThread GlobalFree TlsFree GetStringTypeW InitializeCriticalSectionAndSpinCount OpenMutexA

user32

LoadCursorA FindWindowExA GetWindowRect IsWindowVisible GetWindowTextA EndPaint WaitForInputIdle EnumChildWindows ShowWindow BeginPaint KillTimer UpdateWindow RegisterClassExA GetSystemMetrics SystemParametersInfoA GetForegroundWindow TranslateMessage DispatchMessageA SetTimer DestroyWindow SetWindowPos RegisterClassA CreateWindowExA GetClientRect RegisterWindowMessageA FindWindowA SendMessageA wsprintfA PostMessageA GetWindowThreadProcessId GetClassNameA SetWindowLongW SetWindowLongA GetWindowLongA SetForegroundWindow DefWindowProcA IsWindowUnicode CallWindowProcW CallWindowProcA IsWindow EnumWindows GetDC PostQuitMessage GetMessageA

gdi32

SelectObject GetObjectA BitBlt DeleteDC CreateDIBitmap CreateCompatibleDC

advapi32

GetLengthSid CreateProcessAsUserA RegCreateKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey ConvertStringSidToSidW DuplicateTokenEx OpenProcessToken SetTokenInformation

shell32

ExtractIconExA

ole32

OleCreate OleUninitialize OleInitialize OleSetContainedObject

oleaut32

VariantInit SysAllocStringLen SysFreeString SysAllocString VariantClear

shlwapi

StrToIntA StrCmpNA StrNCatA StrChrA wnsprintfA StrStrIA StrStrA StrCmpNIA StrRChrA

?CreateCPopup@@YAPAVCPopup@@XZ ?CreateCSmallPopup@@YAPAVCSmallPopup@@XZ ?CreateStringTable@@YAPAVCStringTable@@XZ ?GetBrowserUtil@@YAPAVCBrowserUtil@@XZ ?GetCfgFileName@@YGHPADH@Z ?GetCfgFilePath@@YGHPADH@Z ?GetCheckPopServer@@YGHPADK0@Z ?GetClientId@@YGHPADK0@Z ?GetClientInstallDate@@YG?AU_FILETIME@@XZ ?GetCommon@@YAPAVCCommon@@XZ ?GetConfigParams1@@YGXPADK0K0K0K0K0K0KPAPADK0K@Z ?GetCrc64@@YGHPADK0@Z ?GetDefaultCfgServer@@YGHPADK0@Z ?GetExcludedUrlsSeq@@YGKPAD@Z ?GetGeoIPCountryCode@@YGHPADH0@Z ?GetLastPopupTimeNT@@YG?AU_FILETIME@@PAD@Z ?GetLastPopupTimeT@@YG?AU_FILETIME@@PAD@Z ?GetPopupCountNT@@YGKPAD@Z ?GetPopupCountT@@YGKPAD@Z ?GetPopupsStatusDisabled@@YGHPAD@Z ?GetWS2SendFrame@@YGHPADK@Z ?IsHeaderFirstRun@@YGHXZ ?IsPopupEngineDisabled@@YGHXZ ?MyCfgGetDWORD@@YGKPAD0@Z ?MyCfgGetString@@YGHPAD0H0@Z ?MyCfgReadKeyNames@@YGHPADH@Z ?MyCfgSetDWORD@@YGHPADK0@Z ?MyCfgSetString@@YGHPAD00@Z ?SaveFileToDisk@@YAHPADPBXH@Z ?SetCheckPopServer@@YGHPAD0@Z ?SetClientId@@YGHPAD0@Z ?SetClientInstallDate@@YGXU_FILETIME@@@Z ?SetCrc64@@YGHPAD0@Z ?SetDefaultCfgServer@@YGHPAD0@Z ?SetExcludedUrlsSeq@@YGHKPAD@Z ?SetGeoIPCountryCode@@YGHPAD0@Z ?SetHeaderFirstRun@@YGXH@Z ?SetLastPopupTimeNT@@YGHU_FILETIME@@PAD@Z ?SetLastPopupTimeT@@YGHU_FILETIME@@PAD@Z ?SetPopupCountNT@@YGHKPAD@Z ?SetPopupCountT@@YGHKPAD@Z ?SetPopupEngineStatus@@YGXH@Z ?SetPopupsStatusDisabled@@YGHKPAD@Z ?is_ip_address@@YGHPAD@Z ?xml_parse_config@@YGHPADPAPAU_tagCONFIG_STRUCT@@PAHPAVCStringTable@@@Z DllCanUnloadNow DllRegisterServer DllUnregisterServer GetAdLocation GetUuid SetAdLocation SetUuid

Sharing

General

Malware Config

Signatures

File Explorer

3d692c234b503c96e3dd7f8b668683ea

ws2_32

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic