9a86e9859c717ecf6a923082835df127

Sharing

Copy URL Twitter E-mail

General

Target
9a86e9859c717ecf6a923082835df127
Size 128KB
Sample240214-cy9fdsef61
SHA256 76794c0d85527b66a23960dd6d8a803e4bb114d714af0301797aefe578e28af0
MD5 9a86e9859c717ecf6a923082835df127
SHA1 20e3a1be680f8f839fa195913aad4987cf93fe8e
SHA512 be7f41a404137e4c3223ffec18013a95c5ae7c58588bf8b7e60efa4542e57012f4f5103afe018c6241a4604689fe62e4547c002526400d55939d6c7e609c0806
SSDEEP 3072:LdtxqTnCre23I0IgbPUKnrJG2j/ecG8Bl48XZ:5qoeV0I0VdG2j/48Bl48J
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9a86e9859c717ecf6a923082835df127

File Explorer

9a86e9859c717ecf6a923082835df127

.dll 128KB

9a86e9859c717ecf6a923082835df127

IMPHASH bd2e0f1ca4e49d3b00182f00afb78819
SHA256 76794c0d85527b66a23960dd6d8a803e4bb114d714af0301797aefe578e28af0
MD5 9a86e9859c717ecf6a923082835df127
SHA1 20e3a1be680f8f839fa195913aad4987cf93fe8e
SHA512 be7f41a404137e4c3223ffec18013a95c5ae7c58588bf8b7e60efa4542e57012f4f5103afe018c6241a4604689fe62e4547c002526400d55939d6c7e609c0806
SSDEEP 3072:LdtxqTnCre23I0IgbPUKnrJG2j/ecG8Bl48XZ:5qoeV0I0VdG2j/48Bl48J
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Documents and Settings\Renat\Мои документы\Visual Studio Projects\Web projects\ie-ware\Release\ie-ware.pdb

kernel32

lstrlenW lstrcmpiA lstrlenA CloseHandle WriteFile CreateFileA CreateThread InitializeCriticalSection DeleteCriticalSection GetLastError GetShortPathNameA GetModuleFileNameA LeaveCriticalSection InterlockedIncrement EnterCriticalSection lstrcpynA IsDBCSLeadByte InterlockedDecrement Sleep lstrcatA FreeLibrary GetProcAddress LoadLibraryA GetModuleHandleA SizeofResource LoadResource FindResourceA LoadLibraryExA FlushFileBuffers SetStdHandle WideCharToMultiByte MultiByteToWideChar LocalAlloc LocalFree GetVersionExA GetThreadLocale GetLocaleInfoA GetACP lstrcpyA InterlockedExchange IsBadCodePtr IsBadReadPtr SetFilePointer GetStringTypeW GetStringTypeA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount HeapSize GetCurrentProcess TerminateProcess LCMapStringW LCMapStringA VirtualQuery GetSystemInfo VirtualProtect GetCPInfo GetOEMCP ExitProcess HeapFree HeapAlloc RtlUnwind RaiseException GetSystemTimeAsFileTime HeapReAlloc GetCurrentThreadId TlsSetValue GetCommandLineA QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr TlsFree SetLastError TlsGetValue TlsAlloc SetUnhandledExceptionFilter

user32

CharNextA

advapi32

RegDeleteValueA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegDeleteKeyA RegOpenKeyA RegSetValueExA RegCloseKey RegQueryValueExA RegQueryInfoKeyA

shell32

SHGetFileInfoA

ole32

StringFromCLSID CoTaskMemAlloc StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoTaskMemFree

oleaut32

VariantInit SysFreeString SysAllocString SysStringLen VarUI4FromStr LoadRegTypeLi LoadTypeLi VariantClear DispCallFunc UnRegisterTypeLi RegisterTypeLi

shlwapi

PathFindExtensionA

ws2_32

connect gethostbyname socket setsockopt htons send recv inet_addr

Sharing

General

Malware Config

Signatures

File Explorer

9a86e9859c717ecf6a923082835df127

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

generic