8c256a65e7da68c502b6f097bb47448c

Sharing

Copy URL Twitter E-mail

General

Target
8c256a65e7da68c502b6f097bb47448c
Size 1.4MB
Sample240203-mx9pwafdd2
SHA256 bad62215630bcc5bc4dfdf816a67e4b50b87ec20bbf21c60452573fbc74f32a1
MD5 8c256a65e7da68c502b6f097bb47448c
SHA1 5520d553c6eaf8e9c98125b8bf1bab52a71c1197
SHA512 ea5043e7e2500a457bfd4143a440da67ef41a10c0c3c67d78c2927cf3f8c3bb7ddc02cf43c8f301fb5ff9070ffe8ec40645a8264ce14afbabb6a53dd23608d51
SSDEEP 12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c256a65e7da68c502b6f097bb47448c

File Explorer

8c256a65e7da68c502b6f097bb47448c

.dll 1.4MB

8c256a65e7da68c502b6f097bb47448c

IMPHASH 6668be91e2c948b183827f040944057f
SHA256 bad62215630bcc5bc4dfdf816a67e4b50b87ec20bbf21c60452573fbc74f32a1
MD5 8c256a65e7da68c502b6f097bb47448c
SHA1 5520d553c6eaf8e9c98125b8bf1bab52a71c1197
SHA512 ea5043e7e2500a457bfd4143a440da67ef41a10c0c3c67d78c2927cf3f8c3bb7ddc02cf43c8f301fb5ff9070ffe8ec40645a8264ce14afbabb6a53dd23608d51
SSDEEP 12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

266352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

GetTapi16CallbackMsg LAddrParamsInited LOpenDialAsst LocWizardDlgProc MMCAddProvider MMCConfigProvider MMCGetAvailableProviders MMCGetDeviceFlags MMCGetLineInfo MMCGetLineStatus MMCGetPhoneInfo MMCGetPhoneStatus MMCGetProviderList MMCGetServerConfig MMCInitialize MMCRemoveProvider MMCSetLineInfo MMCSetPhoneInfo MMCSetServerConfig MMCShutdown NonAsyncEventThread TAPIWndProc TUISPIDLLCallback internalConfig internalCreateDefLocation internalNewLocationW internalPerformance internalRemoveLocation internalRenameLocationW lineAccept lineAddProvider lineAddProviderA lineAddProviderW lineAddToConference lineAgentSpecific lineAnswer lineBlindTransfer lineBlindTransferA lineBlindTransferW lineClose lineCompleteCall lineCompleteTransfer lineConfigDialog lineConfigDialogA lineConfigDialogEdit lineConfigDialogEditA lineConfigDialogEditW lineConfigDialogW lineConfigProvider lineCreateAgentA lineCreateAgentSessionA lineCreateAgentSessionW lineCreateAgentW lineDeallocateCall lineDevSpecific lineDevSpecificFeature lineDial lineDialA lineDialW lineDrop lineForward lineForwardA lineForwardW lineGatherDigits lineGatherDigitsA lineGatherDigitsW lineGenerateDigits lineGenerateDigitsA lineGenerateDigitsW lineGenerateTone lineGetAddressCaps lineGetAddressCapsA lineGetAddressCapsW lineGetAddressID lineGetAddressIDA lineGetAddressIDW lineGetAddressStatus lineGetAddressStatusA lineGetAddressStatusW lineGetAgentActivityListA lineGetAgentActivityListW lineGetAgentCapsA lineGetAgentCapsW lineGetAgentGroupListA lineGetAgentGroupListW lineGetAgentInfo lineGetAgentSessionInfo lineGetAgentSessionList lineGetAgentStatusA lineGetAgentStatusW lineGetAppPriority lineGetAppPriorityA lineGetAppPriorityW lineGetCallInfo lineGetCallInfoA lineGetCallInfoW lineGetCallStatus lineGetConfRelatedCalls lineGetCountry lineGetCountryA lineGetCountryW lineGetDevCaps lineGetDevCapsA lineGetDevCapsW lineGetDevConfig lineGetDevConfigA lineGetDevConfigW lineGetGroupListA lineGetGroupListW lineGetID lineGetIDA lineGetIDW lineGetIcon lineGetIconA lineGetIconW lineGetLineDevStatus lineGetLineDevStatusA lineGetLineDevStatusW lineGetMessage lineGetNewCalls lineGetNumRings lineGetProviderList lineGetProviderListA lineGetProviderListW lineGetProxyStatus lineGetQueueInfo lineGetQueueListA lineGetQueueListW lineGetRequest lineGetRequestA lineGetRequestW lineGetStatusMessages lineGetTranslateCaps lineGetTranslateCapsA lineGetTranslateCapsW lineHandoff lineHandoffA lineHandoffW lineHold lineInitialize lineInitializeExA lineInitializeExW lineMakeCall lineMakeCallA lineMakeCallW lineMonitorDigits lineMonitorMedia lineMonitorTones lineNegotiateAPIVersion lineNegotiateExtVersion lineOpen lineOpenA lineOpenW linePark lineParkA lineParkW linePickup linePickupA linePickupW linePrepareAddToConference linePrepareAddToConferenceA linePrepareAddToConferenceW lineProxyMessage lineProxyResponse lineRedirect lineRedirectA lineRedirectW lineRegisterRequestRecipient lineReleaseUserUserInfo lineRemoveFromConference lineRemoveProvider lineSecureCall lineSendUserUserInfo lineSetAgentActivity lineSetAgentGroup lineSetAgentMeasurementPeriod lineSetAgentSessionState lineSetAgentState lineSetAgentStateEx lineSetAppPriority lineSetAppPriorityA lineSetAppPriorityW lineSetAppSpecific lineSetCallData lineSetCallParams lineSetCallPrivilege lineSetCallQualityOfService lineSetCallTreatment lineSetCurrentLocation lineSetDevConfig lineSetDevConfigA lineSetDevConfigW lineSetLineDevStatus lineSetMediaControl lineSetMediaMode lineSetNumRings lineSetQueueMeasurementPeriod lineSetStatusMessages lineSetTerminal lineSetTollList lineSetTollListA lineSetTollListW lineSetupConference lineSetupConferenceA lineSetupConferenceW lineSetupTransfer lineSetupTransferA lineSetupTransferW lineShutdown lineSwapHold lineTranslateAddress lineTranslateAddressA lineTranslateAddressW lineTranslateDialog lineTranslateDialogA lineTranslateDialogW lineUncompleteCall lineUnhold lineUnpark lineUnparkA lineUnparkW phoneClose phoneConfigDialog phoneConfigDialogA phoneConfigDialogW phoneDevSpecific phoneGetButtonInfo phoneGetButtonInfoA phoneGetButtonInfoW phoneGetData phoneGetDevCaps phoneGetDevCapsA phoneGetDevCapsW phoneGetDisplay phoneGetGain phoneGetHookSwitch phoneGetID phoneGetIDA phoneGetIDW phoneGetIcon phoneGetIconA phoneGetIconW phoneGetLamp phoneGetMessage phoneGetRing phoneGetStatus phoneGetStatusA phoneGetStatusMessages phoneGetStatusW phoneGetVolume phoneInitialize phoneInitializeExA phoneInitializeExW phoneNegotiateAPIVersion phoneNegotiateExtVersion phoneOpen phoneSetButtonInfo phoneSetButtonInfoA phoneSetButtonInfoW phoneSetData phoneSetDisplay phoneSetGain phoneSetHookSwitch phoneSetLamp phoneSetRing phoneSetStatusMessages phoneSetVolume phoneShutdown tapiGetLocationInfo tapiGetLocationInfoA tapiGetLocationInfoW tapiRequestDrop tapiRequestMakeCall tapiRequestMakeCallA tapiRequestMakeCallW tapiRequestMediaCall tapiRequestMediaCallA tapiRequestMediaCallW

Name

.text

Size

260KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

404KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

96KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

300B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.qkm

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cvjb

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tlmkv

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wucsxe

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fltwtj

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sfplio

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rpg

Size

280KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bewzc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vksvaw

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wmhg

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kswemc

Size

4KB

Virtual Size

877B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kaxfk

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.wualk

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qwqp

Size

4KB

Virtual Size

905B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.txp

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ezxpm

Size

4KB

Virtual Size

318B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.aal

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xriv

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.txpjic

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=483, id=204, productName=VS2012 UPD4 build 61030, version=61030,

count=354, id=261, productName=VS2015 UPD1 build 23506, version=23506,

count=443, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=483, id=223, productName=VS2013 UPD2 build 30501, version=30501,

count=80, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=256, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=161, id=260, productName=VS2017 v15.5.4 build 25834, version=25834,

count=478, id=158, productName=VS2010 build 30319, version=30319,

count=475, id=201, productName=VS2012 UPD3 build 60610, version=60610,

count=389, id=258, productName=VS2017 v15.5.4 build 25834, version=25834,

count=133, id=206, productName=VS2012 UPD2 build 60315, version=60315,

count=405, id=256, productName=VS2015 UPD1 build 23506, version=23506,

count=491, id=201, productName=VS2012 UPD4 build 61030, version=61030,

count=144, id=204, productName=VS2012 UPD2 build 60315, version=60315,

count=495, id=204, productName=VS2012 UPD2 build 60315, version=60315,

count=424, id=206, productName=VS2012 build 50727, version=50727,

count=171, id=222, productName=VS2013 UPD5 build 40629, version=40629,

count=194, id=147, productName=VS2008 build 21022, version=21022,

count=122, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,

count=180, id=203, productName=VS2012 UPD1 build 51106, version=51106,

count=302, id=1, productName=Unmarked objects,

count=142, id=145, productName=VS2008 build 21022, version=21022,

count=58, id=257, productName=VS2015 [14.0] build 23026, version=23026,

8c256a65e7da68c502b6f097bb47448c

user32

setupapi

kernel32

gdi32

crypt32

advapi32

shlwapi

generic