587d3473e7e68f7a825dd6df305297a7

Sharing

Copy URL Twitter E-mail

General

Target
587d3473e7e68f7a825dd6df305297a7
Size 1.7MB
Sample240113-knmsmsfcbn
SHA256 4be53090f377d914d1fe430c040ccf2dcc7307dd5cd1191bdbbdef6a1f507ef6
MD5 587d3473e7e68f7a825dd6df305297a7
SHA1 705a4a7781935f8f0dc8badf815cb5ce8f992dc4
SHA512 fd9c344d9811b1114d5a0b00c44a8c8777ba98fec32ffd3fb53ca4da14a3b1fed58f7d8adda3f761c0230b385bb1a166599b016a3d483f9d8a29acf151231e57
SSDEEP 12288:6VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1k:nfP7fWsK5z9A+WGAW+V5SB6Ct4bnbk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
587d3473e7e68f7a825dd6df305297a7

File Explorer

587d3473e7e68f7a825dd6df305297a7

.dll 1.7MB

587d3473e7e68f7a825dd6df305297a7

IMPHASH 6668be91e2c948b183827f040944057f
SHA256 4be53090f377d914d1fe430c040ccf2dcc7307dd5cd1191bdbbdef6a1f507ef6
MD5 587d3473e7e68f7a825dd6df305297a7
SHA1 705a4a7781935f8f0dc8badf815cb5ce8f992dc4
SHA512 fd9c344d9811b1114d5a0b00c44a8c8777ba98fec32ffd3fb53ca4da14a3b1fed58f7d8adda3f761c0230b385bb1a166599b016a3d483f9d8a29acf151231e57
SSDEEP 12288:6VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1k:nfP7fWsK5z9A+WGAW+V5SB6Ct4bnbk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

LogonIdFromWinStationNameA LogonIdFromWinStationNameW RemoteAssistancePrepareSystemRestore ServerGetInternetConnectorStatus ServerLicensingClose ServerLicensingDeactivateCurrentPolicy ServerLicensingFreePolicyInformation ServerLicensingGetAvailablePolicyIds ServerLicensingGetPolicy ServerLicensingGetPolicyInformationA ServerLicensingGetPolicyInformationW ServerLicensingLoadPolicy ServerLicensingOpenA ServerLicensingOpenW ServerLicensingSetPolicy ServerLicensingUnloadPolicy ServerQueryInetConnectorInformationA ServerQueryInetConnectorInformationW ServerSetInternetConnectorStatus WinStationActivateLicense WinStationAutoReconnect WinStationBroadcastSystemMessage WinStationCheckAccess WinStationCheckLoopBack WinStationCloseServer WinStationConnectA WinStationConnectCallback WinStationConnectEx WinStationConnectW WinStationDisconnect WinStationEnumerateA WinStationEnumerateExW WinStationEnumerateLicenses WinStationEnumerateProcesses WinStationEnumerateW WinStationEnumerate_IndexedA WinStationEnumerate_IndexedW WinStationFreeConsoleNotification WinStationFreeGAPMemory WinStationFreeMemory WinStationFreePropertyValue WinStationFreeUserCertificates WinStationFreeUserCredentials WinStationGenerateLicense WinStationGetAllProcesses WinStationGetAllSessionsW WinStationGetConnectionProperty WinStationGetDeviceId WinStationGetInitialApplication WinStationGetLanAdapterNameA WinStationGetLanAdapterNameW WinStationGetLoggedOnCount WinStationGetMachinePolicy WinStationGetProcessSid WinStationGetRestrictedLogonInfo WinStationGetSessionIds WinStationGetTermSrvCountersValue WinStationGetUserCertificates WinStationGetUserCredentials WinStationGetUserProfile WinStationInstallLicense WinStationIsHelpAssistantSession WinStationIsSessionPermitted WinStationIsSessionRemoteable WinStationNameFromLogonIdA WinStationNameFromLogonIdW WinStationNegotiateSession WinStationNtsdDebug WinStationOpenServerA WinStationOpenServerExA WinStationOpenServerExW WinStationOpenServerW WinStationQueryAllowConcurrentConnections WinStationQueryEnforcementCore WinStationQueryInformationA WinStationQueryInformationW WinStationQueryLicense WinStationQueryLogonCredentialsW WinStationQuerySessionVirtualIP WinStationQueryUpdateRequired WinStationRedirectErrorMessage WinStationRedirectLogonBeginPainting WinStationRedirectLogonError WinStationRedirectLogonMessage WinStationRedirectLogonStatus WinStationRegisterConsoleNotification WinStationRegisterConsoleNotificationEx WinStationRegisterNotificationEvent WinStationRemoveLicense WinStationRenameA WinStationRenameW WinStationReportUIResult WinStationReset WinStationRevertFromServicesSession WinStationSendMessageA WinStationSendMessageW WinStationSendWindowMessage WinStationServerPing WinStationSetAutologonPassword WinStationSetInformationA WinStationSetInformationW WinStationSetPoolCount WinStationShadow WinStationShadowStop WinStationShutdownSystem WinStationSwitchToServicesSession WinStationSystemShutdownStarted WinStationSystemShutdownWait WinStationTerminateProcess WinStationUnRegisterConsoleNotification WinStationUnRegisterNotificationEvent WinStationUserLoginAccessCheck WinStationVerify WinStationVirtualOpen WinStationVirtualOpenEx WinStationWaitSystemEvent _NWLogonQueryAdmin _NWLogonSetAdmin _WinStationAnnoyancePopup _WinStationBeepOpen _WinStationBreakPoint _WinStationCallback _WinStationCheckForApplicationName _WinStationFUSCanRemoteUserDisconnect _WinStationGetApplicationInfo _WinStationNotifyDisconnectPipe _WinStationNotifyLogoff _WinStationNotifyLogon _WinStationNotifyNewSession _WinStationOpenSessionDirectory _WinStationReInitializeSecurity _WinStationReadRegistry _WinStationSessionInitialized _WinStationShadowTarget _WinStationShadowTarget2 _WinStationShadowTargetSetup _WinStationUpdateClientCachedCredentials _WinStationUpdateSettings _WinStationUpdateUserConfig _WinStationWaitForConnect

Name

.text

Size

260KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.qkm

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cvjb

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tlmkv

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wucsxe

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fltwtj

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sfplio

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rpg

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bewzc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vksvaw

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wmhg

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nfuu

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cqcgue

Size

4KB

Virtual Size

503B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edydzn

Size

4KB

Virtual Size

539B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fgoks

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fdf

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vlyui

Size

4KB

Virtual Size

318B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.onihaq

Size

4KB

Virtual Size

802B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qdwh

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.usxtn

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=483, id=204, productName=VS2012 UPD4 build 61030, version=61030,

count=354, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=443, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=483, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=80, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=256, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=161, id=260, productName=VS2017 v15.5.4 build 25834, version=25834,

count=478, id=158, productName=VS2010 build 30319, version=30319,

count=475, id=201, productName=VS2012 UPD3 build 60610, version=60610,

count=389, id=258, productName=VS2017 v15.5.4 build 25834, version=25834,

count=133, id=206, productName=VS2012 UPD2 build 60315, version=60315,

count=405, id=256, productName=VS2015 UPD1 build 23506, version=23506,

count=491, id=201, productName=VS2012 UPD4 build 61030, version=61030,

count=144, id=204, productName=VS2012 UPD2 build 60315, version=60315,

count=495, id=204, productName=VS2012 UPD2 build 60315, version=60315,

count=424, id=206, productName=VS2012 build 50727, version=50727,

count=171, id=222, productName=VS2013 UPD5 build 40629, version=40629,

count=194, id=147, productName=VS2008 build 21022, version=21022,

count=122, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

count=180, id=203, productName=VS2012 UPD1 build 51106, version=51106,

count=302, id=1, productName=Unmarked objects,

count=142, id=145, productName=VS2008 build 21022, version=21022,

count=58, id=257, productName=VS2015 [14.0] build 23026, version=23026,

587d3473e7e68f7a825dd6df305297a7

user32

setupapi

kernel32

gdi32

crypt32

advapi32

shlwapi

generic