751652d2b6303f5f9d62a197822efc47

Sharing

Copy URL Twitter E-mail

General

Target
751652d2b6303f5f9d62a197822efc47
Size 173KB
Sample240125-vzexaacear
SHA256 38ffa5781675a1482509571179f98395dff202144f0b42b89a257e5e065ebac5
MD5 751652d2b6303f5f9d62a197822efc47
SHA1 5d3702268d083baa716c70b701ddba48e660f659
SHA512 80acdf079b21505fc58d52c33401d9acee06d5c3e5057b3a5a5a670cb06909657a740f8a28605b06c312be95b42fdbe6e395478d2e056146b7b49d37f22fcc01
SSDEEP 3072:LAhIGJDzRxW2MRG5a5R0P588u0Q+suhlT2BoBVy4AtLRVVLJt/Of6RGaUaS:LAhIGJDzRxZMRG5a5R0PNKqlT2MVQVLn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
751652d2b6303f5f9d62a197822efc47

File Explorer

751652d2b6303f5f9d62a197822efc47

.dll 173KB

751652d2b6303f5f9d62a197822efc47

IMPHASH 567a182d028a8c6144038163c96f6fd0
SHA256 38ffa5781675a1482509571179f98395dff202144f0b42b89a257e5e065ebac5
MD5 751652d2b6303f5f9d62a197822efc47
SHA1 5d3702268d083baa716c70b701ddba48e660f659
SHA512 80acdf079b21505fc58d52c33401d9acee06d5c3e5057b3a5a5a670cb06909657a740f8a28605b06c312be95b42fdbe6e395478d2e056146b7b49d37f22fcc01
SSDEEP 3072:LAhIGJDzRxW2MRG5a5R0P588u0Q+suhlT2BoBVy4AtLRVVLJt/Of6RGaUaS:LAhIGJDzRxZMRG5a5R0PNKqlT2MVQVLn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualQueryEx GetVolumeInformationA Sleep ReadProcessMemory IsBadWritePtr TerminateProcess FlushInstructionCache VerifyVersionInfoW FindFirstFileA GetProcAddress VirtualAlloc VirtualProtectEx DisableThreadLibraryCalls VirtualAllocEx FindClose LoadLibraryA Process32Next GetWindowsDirectoryA FindNextFileA GetModuleHandleA VirtualProtect CreateToolhelp32Snapshot GetCurrentThreadId GetCurrentProcessId GetTempPathA GetSystemTime DeleteFileA MulDiv GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedCompareExchange InterlockedExchange IsBadReadPtr GetTickCount Process32First QueryPerformanceCounter VerSetConditionMask GetComputerNameA GetVersionExA GetLastError GetCurrentProcess DecodePointer EncodePointer GetSystemInfo IsProcessorFeaturePresent

user32

GetCursorPos

gdi32

CreateFontA GetTextExtentPoint32A SetTextColor DeleteDC CreateDIBSection ExtTextOutA GetDeviceCaps SetBkColor DeleteObject SelectObject CreateCompatibleDC SetMapMode SetTextAlign

advapi32

GetUserNameA

msvcr100

_except_handler4_common ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _crt_debugger_hook ??1exception@std@@UAE@XZ __CppXcptFilter _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt _onexit _lock __dllonexit _unlock _strdup strchr exit _time64 _localtime64 _vsnprintf ?what@exception@std@@UBEPBDXZ ??_V@YAXPAX@Z printf ??_U@YAPAXI@Z sprintf_s rename strncpy vsprintf_s malloc free sprintf ??2@YAPAXI@Z fclose fwrite memcpy_s ??3@YAXPAX@Z _lock_file setvbuf fsetpos fgetc fflush _fseeki64 fgetpos ungetc _unlock_file memmove ??0exception@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABQBD@Z __clean_type_info_names_internal ??0bad_cast@std@@QAE@ABV01@@Z ??0bad_cast@std@@QAE@PBD@Z _CxxThrowException memcpy _CIcos _CIsin ??1bad_cast@std@@UAE@XZ fputc _CIsqrt memset __CxxFrameHandler3 clock

msvcp100

?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?uncaught_exception@std@@YA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??Bid@locale@std@@QAEIXZ ?_Incref@facet@locale@std@@QAEXXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?_BADOFF@std@@3_JB ?_Xout_of_range@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Xlength_error@std@@YAXPBD@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ

d3dx9_38

D3DXMatrixInverse

netapi32

NetApiBufferFree NetWkstaGetInfo

Sharing

General

Malware Config

Signatures

File Explorer

751652d2b6303f5f9d62a197822efc47

kernel32

user32

gdi32

advapi32

msvcr100

msvcp100

d3dx9_38

netapi32

generic