45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29

Sharing

Copy URL Twitter E-mail

General

Target
45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29
Size 4.8MB
Sample240108-bf2gdsaeg4
SHA256 45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29
MD5 2ae2afe384b57eb18f8ed8d1f69c87a8
SHA1 6b067bd8df8e34eb962001b724325495d276715b
SHA512 5bceeb8125179e86050735ae5c640bf9ee0da16ff4b13660c6df2a33772290dedc6eda5c72d3d0f82ee2837936e597e1f8edee741d1864b0f9df434173ab1437
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXB:TcmZl85gyjovK65E8ob5Sx8aXB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29

File Explorer

45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29

.exe 4.8MB

45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29

IMPHASH c8f585918987a310f6428f02fe881c59
SHA256 45a56ff9358d947d465910547ca91a3a5ab406993c6a2baa184779d9da668a29
MD5 2ae2afe384b57eb18f8ed8d1f69c87a8
SHA1 6b067bd8df8e34eb962001b724325495d276715b
SHA512 5bceeb8125179e86050735ae5c640bf9ee0da16ff4b13660c6df2a33772290dedc6eda5c72d3d0f82ee2837936e597e1f8edee741d1864b0f9df434173ab1437
SSDEEP 98304:seLpmrmc2lAu28lkcf5YjovKqGYiOE8oLj5YINfSyo8aXB:TcmZl85gyjovK65E8ob5Sx8aXB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

182709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SizeofResource ReadFile FindClose CloseHandle MulDiv GetSystemTime CreatePipe PeekNamedPipe lstrcmpW lstrcmpiW lstrcpynW lstrlenA lstrlenW CreateMutexW LoadLibraryW LoadLibraryExW GetModuleFileNameW GetModuleHandleW CreateProcessW GetStartupInfoW FindResourceW FindResourceExW GetSystemDirectoryW DeleteFileW FindFirstFileW FindNextFileW GetVersionExW MultiByteToWideChar WideCharToMultiByte LocalFree GetCommandLineW GetWindowsDirectoryW WritePrivateProfileStringW IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetFileSize WriteFile FlushFileBuffers CreateFileW DeviceIoControl lstrcmpA lstrcmpiA CreateFileA RtlUnwind TlsAlloc TlsGetValue TlsSetValue LeaveCriticalSection CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetACP Sleep GetFileType LCMapStringW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObjectEx SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW WriteConsoleW InterlockedCompareExchange GetPrivateProfileStringW LocalAlloc GetSystemInfo ResetEvent CreateDirectoryW GetTempFileNameW FormatMessageW GlobalAddAtomW TerminateThread CopyFileW ReleaseMutex GetExitCodeProcess GetFileAttributesExW CreateFileMappingW UnmapViewOfFile MapViewOfFile SetFilePointer WaitForMultipleObjects GetExitCodeThread MoveFileW GetLocalTime GetFileSizeEx GlobalFree MoveFileExW GetFileAttributesW SetFileAttributesW GetTickCount GetFullPathNameW RemoveDirectoryW GetDiskFreeSpaceExW GetTempPathW GetDriveTypeW GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalFindAtomW GlobalDeleteAtom OpenProcess GetLongPathNameW CreateEventW SetEvent LoadResource GetStringTypeW EnterCriticalSection InitializeCriticalSection SetErrorMode SetLastError GetCurrentThreadId GetCurrentProcess GlobalMemoryStatusEx GlobalUnlock GlobalLock GlobalAlloc GetProcAddress FreeLibrary LockResource InterlockedDecrement InterlockedIncrement FreeResource GetSystemWindowsDirectoryW SetEndOfFile SetFileTime WaitForSingleObject GetFileInformationByHandle GetModuleHandleA InterlockedExchange DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy TlsFree

user32

MonitorFromWindow LoadImageW PtInRect GetCursorPos MonitorFromPoint DialogBoxParamW CopyRect EndDialog LoadCursorW TrackPopupMenu AppendMenuW DestroyMenu GetSystemMetrics KillTimer SetTimer IsIconic UnregisterClassW ShowWindowAsync CharUpperW SetWindowLongW GetDesktopWindow GetParent FindWindowW GetClassNameW CreatePopupMenu GetWindow MessageBoxW UnhookWinEvent SetWinEventHook SystemParametersInfoW SetCursor OffsetRect SetWindowRgn UpdateLayeredWindow SetRect GetMonitorInfoW UpdateWindow PostQuitMessage IsRectEmpty WaitForInputIdle SendMessageTimeoutW GetWindowThreadProcessId FindWindowExW PostThreadMessageW wsprintfW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SendMessageW GetWindowLongW FillRect GetSysColor MapWindowPoints ScreenToClient ClientToScreen GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow InvalidateRgn InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow DestroyAcceleratorTable CreateAcceleratorTableW ReleaseCapture SetCapture GetFocus SetFocus CharNextW GetDlgItem BringWindowToTop IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostMessageW

shlwapi

PathFindExtensionW StrToInt64ExW wvnsprintfW PathIsDirectoryW wnsprintfW SHStrDupW PathAppendW PathStripToRootW PathFindFileNameW PathIsPrefixW StrToIntW StrCmpIW StrStrIA StrTrimA StrCmpNIW PathFileExistsW PathCombineW PathRemoveFileSpecW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrStrIW wnsprintfA SHDeleteKeyW PathRelativePathToW PathIsRelativeW StrCmpW SHSetValueA

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipDrawImageRectRectI GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipCreateBitmapFromStream GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateBitmapFromStreamICM GdipSetTextRenderingHint GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipCreateSolidFill GdipDeleteBrush GdipDrawImagePointRectI GdipCreateFontFamilyFromName GdipDrawImageRectRect GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile

gdi32

CreateRectRgn EnumFontFamiliesW CreateFontW ExtTextOutW CombineRgn SetTextColor SetBkMode SetBkColor GetCurrentObject CreateFontIndirectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteObject GetDeviceCaps GetStockObject SelectObject GetObjectW RestoreDC SaveDC DeleteDC SetViewportOrgEx

advapi32

GetUserNameW RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW GetTokenInformation GetTrusteeNameW BuildExplicitAccessWithNameW SetNamedSecurityInfoW GetNamedSecurityInfoW GetExplicitEntriesFromAclW SetEntriesInAclW LookupAccountNameW LookupAccountSidW DeleteAce EqualSid LookupPrivilegeValueW RegEnumKeyExW RegDeleteValueW OpenProcessToken AdjustTokenPrivileges

shell32

SHLoadInProc ShellExecuteExW ord75 SHFileOperationW ShellExecuteW ord165 SHChangeNotify CommandLineToArgvW Shell_NotifyIconW SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHGetSpecialFolderPathW ord680

ole32

CoCreateGuid CoInitialize CoUninitialize CoGetClassObject CoSetProxyBlanket CreateStreamOnHGlobal OleLockRunning OleUninitialize OleInitialize PropVariantClear CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CLSIDFromString CoCreateInstance OleRun

oleaut32

SysStringByteLen SysAllocStringByteLen OleCreateFontIndirect LoadRegTypeLi LoadTypeLi VarUI4FromStr VariantClear VariantInit SysStringLen SysFreeString SysAllocStringLen SysAllocString

urlmon

URLDownloadToCacheFileW

psapi

GetModuleFileNameExW EnumProcesses

winhttp

WinHttpOpenRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpSetCredentials WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders

iphlpapi

GetAdaptersInfo

setupapi

SetupIterateCabinetW

generic

count=17, id=241, version=40116,

count=161, id=243, version=40116,

count=30, id=242, version=40116,

count=2, id=264, version=27030,

count=1, productName=Unmarked objects (old),

count=10, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=5, id=261, version=27032,

count=3, id=199, version=41118,

count=23, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=77, id=261, version=26706,

count=35, id=260, version=26706,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=487, id=1, productName=Unmarked objects,

count=79, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=255, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=258, productName=VS2017 v15.9.11 build 27030, version=27030,