de6e3691cde96669fb8f13c5dc833006

Sharing

Copy URL Twitter E-mail

General

Target
de6e3691cde96669fb8f13c5dc833006
Size 952KB
Sample240325-ttd75acf77
SHA256 cdca0ae8c21e4840cae12d88f1e67302ad740db7e554ed2956a1700987145e81
MD5 de6e3691cde96669fb8f13c5dc833006
SHA1 0e097e90d6421f98ca9a3a8982f19bc7da758be8
SHA512 65429e6672749c0065ce18b54286c56c0f8bc5e01b59991415f533847519edb0a996daf63ea8a6ed28e180ba5c5f0dac82c06b0735330084e6387a99382ea8fa
SSDEEP 24576:woFTBsfTu1cT8fAIqqurybCuUg3zch4DIF881w:wo5w3QiquryebgGb881w
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
de6e3691cde96669fb8f13c5dc833006

File Explorer

de6e3691cde96669fb8f13c5dc833006

.dll 952KB

de6e3691cde96669fb8f13c5dc833006

IMPHASH 41fdd86c4eea36d6ac5cbbd007e0c810
SHA256 cdca0ae8c21e4840cae12d88f1e67302ad740db7e554ed2956a1700987145e81
MD5 de6e3691cde96669fb8f13c5dc833006
SHA1 0e097e90d6421f98ca9a3a8982f19bc7da758be8
SHA512 65429e6672749c0065ce18b54286c56c0f8bc5e01b59991415f533847519edb0a996daf63ea8a6ed28e180ba5c5f0dac82c06b0735330084e6387a99382ea8fa
SSDEEP 24576:woFTBsfTu1cT8fAIqqurybCuUg3zch4DIF881w:wo5w3QiquryebgGb881w
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

362632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Brian\Documents\Development\SRL\SystemNVD DLL\build\bin\SystemNVD.pdb

wininet

InternetOpenUrlA InternetReadFile InternetOpenA InternetCloseHandle InternetQueryDataAvailable

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoA

setupapi

SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList

powrprof

GetPwrCapabilities

kernel32

IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetStringTypeW CreateFileA WriteFile CloseHandle lstrcmpA GetSystemInfo QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA GetProcAddress GetLastError WideCharToMultiByte FreeLibrary DeviceIoControl InterlockedDecrement GetSystemDirectoryA GetModuleHandleA GetDiskFreeSpaceA GetLogicalDriveStringsA GetDriveTypeA WriteConsoleA FlushFileBuffers GetTickCount lstrcmpiA GetVersion GetCurrentProcess GetVersionExA GlobalMemoryStatus GetFileSize ReadFile InterlockedExchange CompareStringW CompareStringA MultiByteToWideChar lstrcpyA HeapFree GetProcessHeap GetCurrentProcessId GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA SetFilePointer GetConsoleOutputCP SetStdHandle WriteConsoleW GetLocaleInfoW CreateFileW SetEndOfFile lstrlenA SetEnvironmentVariableA GetConsoleMode GetConsoleCP GetStartupInfoA GetFileType GetStdHandle SetHandleCount IsValidCodePage GetOEMCP GetTimeZoneInformation SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue VirtualFree GetACP GetLocaleInfoA GetThreadLocale InterlockedIncrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime HeapReAlloc HeapAlloc VirtualAlloc GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException LCMapStringA LCMapStringW GetCPInfo ExitProcess HeapDestroy HeapCreate HeapSize

user32

GetForegroundWindow GetSystemMetrics GetDC

gdi32

GetDeviceCaps DeleteDC

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegEnumKeyExA

ole32

CoInitialize CoUninitialize CoSetProxyBlanket CoCreateInstance

oleaut32

SysStringLen VariantClear SysFreeString VariantChangeType SysAllocString VariantCopy VariantInit

Name

.text

Size

352KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

204KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CONST

Size

4KB

Virtual Size

31B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

de6e3691cde96669fb8f13c5dc833006

wininet

version

setupapi

powrprof

kernel32

user32

gdi32

advapi32

ole32

oleaut32

generic