9caf6d11fbb4355cbe423c18174909a6

Sharing

Copy URL Twitter E-mail

General

Target
9caf6d11fbb4355cbe423c18174909a6
Size 302KB
Sample240215-cm4e1aeh72
SHA256 d86ea52ca871d5280063f4c71c3dba639cfd29a02738d5829e1fa31a43ec7336
MD5 9caf6d11fbb4355cbe423c18174909a6
SHA1 3f7f0392925d60ec257b9707db3dcb5ec0b9045e
SHA512 67cd090e0a18a3407d01f1b4055dfa4ad960ef60ecd1ab882431e0053125325ba30be8a9d0c3e27b7a6c7f0636a5d55d2db1eb644711f106fc818b4d9cbff375
SSDEEP 3072:bPQWLzNZo2zDqx0UkXE3/gprIhtNjT+0r7f5dnWs6QN+qStRHEe:bvNZo4XUL/gmjS0r7xEtRR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9caf6d11fbb4355cbe423c18174909a6

File Explorer

9caf6d11fbb4355cbe423c18174909a6

.dll 302KB

9caf6d11fbb4355cbe423c18174909a6

IMPHASH c4096488a194ba24615410b18c53c19d
SHA256 d86ea52ca871d5280063f4c71c3dba639cfd29a02738d5829e1fa31a43ec7336
MD5 9caf6d11fbb4355cbe423c18174909a6
SHA1 3f7f0392925d60ec257b9707db3dcb5ec0b9045e
SHA512 67cd090e0a18a3407d01f1b4055dfa4ad960ef60ecd1ab882431e0053125325ba30be8a9d0c3e27b7a6c7f0636a5d55d2db1eb644711f106fc818b4d9cbff375
SSDEEP 3072:bPQWLzNZo2zDqx0UkXE3/gprIhtNjT+0r7f5dnWs6QN+qStRHEe:bvNZo4XUL/gmjS0r7xEtRR
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\srcnew\plibd\Release\pllib.pdb

kernel32

GetTickCount CloseHandle WriteFile CreateFileW FreeLibrary LoadLibraryExW CreateThread RaiseException lstrcmpiW InterlockedIncrement InterlockedDecrement GetModuleFileNameW MultiByteToWideChar lstrlenW SetThreadLocale GetThreadLocale GetVersionExW WinExec GetWindowsDirectoryW lstrlenA GetProcAddress LoadLibraryW WideCharToMultiByte LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetLastError GetLocaleInfoA GetStringTypeW GetCPInfo GetModuleFileNameA GetStdHandle ExitProcess HeapSize Sleep VirtualAlloc VirtualFree GetACP HeapCreate HeapDestroy SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleA GetProcessHeap GetVersionExA GetCommandLineA GetCurrentThreadId GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess GetStringTypeA LCMapStringW LCMapStringA LoadLibraryA InterlockedExchange GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetOEMCP HeapFree HeapAlloc HeapReAlloc RtlUnwind TerminateProcess

user32

CharLowerA CharNextW MessageBoxW UnregisterClassA

advapi32

IsTextUnicode RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoGetClassObject StringFromGUID2 CoCreateInstance CoTaskMemFree

oleaut32

RegisterTypeLi SysAllocStringLen SysFreeString VarBstrCmp SysAllocString SysAllocStringByteLen SysStringByteLen VarUI4FromStr SysStringLen LoadRegTypeLi VarBstrCat VariantClear UnRegisterTypeLi LoadTypeLi

rpcrt4

NdrStubForwardingFunction NdrOleFree NdrOleAllocate IUnknown_Release_Proxy IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer_Release NdrCStdStubBuffer2_Release NdrDllRegisterProxy NdrDllUnregisterProxy

wininet

HttpSendRequestW InternetReadFile InternetCloseHandle InternetSetCookieW HttpOpenRequestW InternetCrackUrlW InternetOpenW InternetConnectW InternetGetCookieW

urlmon

CoInternetGetSession

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9caf6d11fbb4355cbe423c18174909a6

kernel32

user32

advapi32

shell32

ole32

oleaut32

rpcrt4

wininet

urlmon

version

generic