urelas | d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495

Sharing

Copy URL Twitter E-mail

General

Target
d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495
Size 468KB
Sample240328-arw6dahe43
SHA256 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495
MD5 33b510c73f5209cb1c1dee94e61fa23a
SHA1 21f983a5d601aaac2da1c89cf3bcbaf8dc3777d7
SHA512 8f59f6e9fa8c29f3e68c26b873b9e222c4a8be74ef60b1471655212f89c309b8f86aa07295b3be613722339a6116a8d930a8865446915c9e9daecc6f3be60d4b
SSDEEP 12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1Ux:Y6tQCG0UUPzEkTn4AC1+m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495

File Explorer

d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495

.exe 468KB

d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495

IMPHASH 09eb18457adb53a09f3f97fc04e9e2cf
SHA256 d4ce696d30c7f4506cb921ef1a93876ffa147ba72b5064295f001a78ea5f2495
MD5 33b510c73f5209cb1c1dee94e61fa23a
SHA1 21f983a5d601aaac2da1c89cf3bcbaf8dc3777d7
SHA512 8f59f6e9fa8c29f3e68c26b873b9e222c4a8be74ef60b1471655212f89c309b8f86aa07295b3be613722339a6116a8d930a8865446915c9e9daecc6f3be60d4b
SSDEEP 12288:Y6twjLHj/8/GcHUIdPPzEmvTnabAh0ZnAr1Ux:Y6tQCG0UUPzEkTn4AC1+m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20131107)\GolfUpdate_2008\bin\GolfUpdate.pdb

kernel32

DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA lstrcmpW LoadLibraryA LoadLibraryW TlsAlloc GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA LocalReAlloc HeapAlloc HeapFree GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree VirtualAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap InitializeCriticalSection GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError TlsSetValue SetFileTime CreateDirectoryW WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW GetFileSizeEx FreeResource LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW ExitProcess MultiByteToWideChar CreateThread WriteFile CreateFileA GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetSystemDirectoryW GetTickCount Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetFileAttributesW GetTempPathW GetModuleFileNameW GlobalDeleteAtom GetVersionExW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW LoadAcceleratorsW GetMessageW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx TranslateAcceleratorW TranslateMessage SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW CopyRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject ExtTextOutW SaveDC RestoreDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible SetViewportOrgEx SelectObject Escape TextOutW GetDeviceCaps RectVisible

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit