7522c9ee9466ba97331da148ff91b990

Sharing

Copy URL Twitter E-mail

General

Target
7522c9ee9466ba97331da148ff91b990
Size 10.3MB
Sample240125-we15fscah3
SHA256 7a74fb60899179d6a5696a266139cde1f7a05660c73fccf636650e643ae67d21
MD5 7522c9ee9466ba97331da148ff91b990
SHA1 302c96adb32a2190e0400d7c1c9db80d3649a501
SHA512 5e789947cf6f9f1c0c53abae47be422d7c108e4456749f29837a78ff60d62ccca97a5e0d978bb271fc0d6bf185d0edabbed16f52c25644ef581de300783556ce
SSDEEP 196608:GSNJB1GK19WX4TR5TqbWau8PBsObDa8k+v2cpTxM7u7P/oNgpbCIvZ3KYB8S:GEByKfTbFwDNjpNMu7P/C
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis_winamp.dll

File Explorer

7522c9ee9466ba97331da148ff91b990

.exe 10.3MB
$PLUGINSDIR/Dialer.dll

.dll 3KB
$PLUGINSDIR/nsExec.dll

.dll 6KB
$PLUGINSDIR/nsis_winamp.dll

.dll 4KB

7522c9ee9466ba97331da148ff91b990

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 7a74fb60899179d6a5696a266139cde1f7a05660c73fccf636650e643ae67d21
MD5 7522c9ee9466ba97331da148ff91b990
SHA1 302c96adb32a2190e0400d7c1c9db80d3649a501
SHA512 5e789947cf6f9f1c0c53abae47be422d7c108e4456749f29837a78ff60d62ccca97a5e0d978bb271fc0d6bf185d0edabbed16f52c25644ef581de300783556ce
SSDEEP 196608:GSNJB1GK19WX4TR5TqbWau8PBsObDa8k+v2cpTxM7u7P/oNgpbCIvZ3KYB8S:GEByKfTbFwDNjpNMu7P/C
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

8d:74:25:f5:15:67:82:c4:21:25:e8:9d:ed:83:a4:0d:0c:42:a7:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Winamp,OU=Nullsoft,O=Nullsoft Inc.,C=US

Chains

Jan 13, 2010

Minor OS version

Major OS version

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/Dialer.dll

IMPHASH 08b0635362e7aeb50569ca1a61d5a13f
SHA256 0d9663a5d1eab84f531dcac47a2366d215207ac488f9d452832c5efb91a6d1f9
MD5 692da284b3212a65a8092e6f02804c05
SHA1 852b2943a19f0a7de5e6fa2a47aee8a2ce8e3c66
SHA512 978a8ec097d30c2a8729670e8fdf46464e84c9e701b9739e4937991c07cd06003c0bb01e77ad1e10f30b7ae2fb62b5b7bc724bce4ce644b09177899c6bacb21f
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 08b89132344dad1b0357ca0b442e9aaaff979e6a87b9603c19b86934f455285b
MD5 a272bc9b9df701ef76ed5faf08925b17
SHA1 f2977303d12ba7af38dceb8e5e7ff1c15553211e
SHA512 9ebb0c4b995309a40f1cee05967ef722972baa97b17194bb306fe7c01ea98c058d9485846c55e40601c17e7f2f73a8e5cd74cd9162a046fd4427dbfc7eb0501e
SSDEEP 96:/6spqRy5AOEEQsh+WvDRH3spzQreUvhiT4uF3Telac1nIq4i:/Y0AOEMh+Wv9cZQKUvkTjlaB1nIqH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_winamp.dll

IMPHASH a88d5dd1652a6846cfc944c29f1e3538
SHA256 5946278545abbd0b0f5188752fe095e200c85abe0783632a00726d090c0753ec
MD5 1e1ded1cf1c69852f2074693459fb3b5
SHA1 81b165cae4d38a98760131989fdd8aed2c918679
SHA512 a6f9a43d4432658c3504629e9209ad350af69eff542d139e0ccfe0dbf8662f15034edd3cf8b56d606a740b66c8221cafad999088a4e64a4c9c9fb47793a19f96
SSDEEP 48:SEdAWvTa5HlE1m198EqtjbglT68HY06mzWB+wUKCmMpzm7n4/ZS9:LA2a5Fcm198EqtjMlv47mzWBVgaj4/w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

7522c9ee9466ba97331da148ff91b990

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Dialer.dll

kernel32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsis_winamp.dll

shlwapi

kernel32

user32

shell32

generic