e1dfed24548cfb171c80f398c30dd0b1

Sharing

Copy URL Twitter E-mail

General

Target
e1dfed24548cfb171c80f398c30dd0b1
Size 60KB
Sample240327-rnp2bsdh59
SHA256 76287d82405fb24afaddfa8613e24ce80a8b9292ae743c61e7d6b9aeab0ddb78
MD5 e1dfed24548cfb171c80f398c30dd0b1
SHA1 256f21fefe831fa204a71032aee72f10a61d81e3
SHA512 c59ac1551edabb9d47826692dd6701ba537cde9e51b2d79ef37ee08ba0a3d0c776fc581cd9f21e42cb811da30d861a0d82e1cd8444f14f29ad30836b6ad05aae
SSDEEP 768:+wvnsw/C4S+PkLZm2uWAzzBuuIKlRo4DuHmvqNjiK9dEm5500ixs:Jvu4S+m/AkUo4fv01gms0ixs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1dfed24548cfb171c80f398c30dd0b1

File Explorer

e1dfed24548cfb171c80f398c30dd0b1

.dll 60KB

e1dfed24548cfb171c80f398c30dd0b1

IMPHASH 12b68ef2845d95502041357addc3e082
SHA256 76287d82405fb24afaddfa8613e24ce80a8b9292ae743c61e7d6b9aeab0ddb78
MD5 e1dfed24548cfb171c80f398c30dd0b1
SHA1 256f21fefe831fa204a71032aee72f10a61d81e3
SHA512 c59ac1551edabb9d47826692dd6701ba537cde9e51b2d79ef37ee08ba0a3d0c776fc581cd9f21e42cb811da30d861a0d82e1cd8444f14f29ad30836b6ad05aae
SSDEEP 768:+wvnsw/C4S+PkLZm2uWAzzBuuIKlRo4DuHmvqNjiK9dEm5500ixs:Jvu4S+m/AkUo4fv01gms0ixs
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameW FreeLibrary MultiByteToWideChar lstrlenA SizeofResource LoadResource FindResourceW GetLastError LoadLibraryExW lstrcmpiW lstrcpynW GetModuleHandleW GetProcAddress LoadLibraryW lstrcpyW lstrcatW DeleteFileA WinExec GetBinaryTypeA GetTickCount GetTempPathA WideCharToMultiByte GetShortPathNameW lstrlenW InterlockedDecrement EnterCriticalSection InterlockedIncrement LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection GetLocalTime DisableThreadLibraryCalls GetModuleHandleA GetModuleFileNameA CreateThread Sleep GetCurrentProcess HeapDestroy CloseHandle

user32

SetWindowsHookExW CallNextHookEx CharNextW GetMessageW CharLowerA UnhookWindowsHookEx

advapi32

RegOpenKeyExA RegQueryValueExW RegCreateKeyA RegSetValueExA RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegEnumKeyExW RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegDeleteKeyW

shell32

ShellExecuteA

ole32

CoTaskMemAlloc CoTaskMemRealloc CoCreateInstance CoTaskMemFree

oleaut32

LoadRegTypeLi RegisterTypeLi VariantClear SysAllocString SysFreeString VarUI4FromStr LoadTypeLi SysStringLen

msvcrt

_adjust_fdiv _stricmp _initterm wcscmp wcslen swprintf calloc _access rename fwrite fclose strncmp strchr memcmp realloc malloc free ??2@YAPAXI@Z ??3@YAXPAX@Z _purecall memset sprintf memcpy strcpy strlen strstr fgets fopen _splitpath strcmp strcat atoi

ws2_32

htons inet_addr connect recv send closesocket gethostbyname WSAStartup socket

netapi32

Netbios

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

Name

.text

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

WOWCLin

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e1dfed24548cfb171c80f398c30dd0b1

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcrt

ws2_32

netapi32

wininet

generic