53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b

Sharing

Copy URL Twitter E-mail

General

Target
53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b
Size 349KB
Sample240330-hrlcwabc93
SHA256 53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b
MD5 7828fbe2ff376fc234bb217acfe8a4f7
SHA1 050d83df8aa2bb710093dc6f3964681446f2b5c3
SHA512 681928b8c0136ba1b696575723a2dd3b327e5aaa7a568e54abe744b9e4d8cdeb881f2752e1922846c3645516059bedb350728a3c29f5975f9916ea9d5b6cd19f
SSDEEP 6144:oTH64ZN4c9OUfsTGvZ3F99vimQ4eu7d4niLlabQRqR6Goh8UBIaxp/U+0:o2cN4c9OAsaBfhQK4niLYb/o2UBZPU+0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b

File Explorer

53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b

.exe 349KB

53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b

IMPHASH f532c9acf6574838784e1cb9197ea379
SHA256 53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b
MD5 7828fbe2ff376fc234bb217acfe8a4f7
SHA1 050d83df8aa2bb710093dc6f3964681446f2b5c3
SHA512 681928b8c0136ba1b696575723a2dd3b327e5aaa7a568e54abe744b9e4d8cdeb881f2752e1922846c3645516059bedb350728a3c29f5975f9916ea9d5b6cd19f
SSDEEP 6144:oTH64ZN4c9OUfsTGvZ3F99vimQ4eu7d4niLlabQRqR6Goh8UBIaxp/U+0:o2cN4c9OAsaBfhQK4niLYb/o2UBZPU+0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132420

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ZoneAlarmCrashHandler64_unsigned.pdb

kernel32

GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCurrentProcess TerminateProcess ExitProcess GetModuleHandleExW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStdHandle WriteFile GetACP GetCurrentThread LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType OutputDebugStringA CloseHandle CreateThread SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW LoadLibraryW SizeofResource LockResource LoadResource FindResourceW GetCurrentThreadId LocalFree CreateDirectoryW DeleteFileW RemoveDirectoryW GetTickCount WaitForMultipleObjects WaitForSingleObject GetExitCodeProcess DuplicateHandle ReleaseMutex GetEnvironmentVariableW lstrcmpiW VirtualQuery GetTempPathW GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW Sleep lstrcmpW lstrlenW SetFilePointer CreateMutexW GetCurrentProcessId InitializeCriticalSection TryEnterCriticalSection SetEvent ResetEvent GetFileAttributesExW VerifyVersionInfoW VerSetConditionMask MoveFileExW GetFileTime ReadFile DeviceIoControl SetProcessWorkingSetSize OpenProcess CreateProcessW ReadProcessMemory lstrcpynW GlobalAlloc GlobalLock GlobalUnlock GlobalFree WaitForDebugEvent GetProcessId DebugActiveProcessStop ContinueDebugEvent GetSystemInfo GetThreadContext DebugActiveProcess VirtualQueryEx QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LeaveCriticalSection WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState ReleaseSemaphore CreateSemaphoreW EnterCriticalSection OutputDebugStringW GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize IsDebuggerPresent CreateEventW GetUserDefaultLangID GetSystemDefaultLangID GetComputerNameExW GetOverlappedResult ConnectNamedPipe CreateNamedPipeW DisconnectNamedPipe UnregisterWait GetProcessTimes UnregisterWaitEx RegisterWaitForSingleObject VirtualProtect VirtualAlloc EncodePointer RtlPcToFileHeader InitializeCriticalSectionAndSpinCount FindResourceExW HeapFree

user32

SetClipboardData EmptyClipboard OpenClipboard GetProcessWindowStation CloseDesktop CloseClipboard CharUpperW PostThreadMessageW DispatchMessageW GetMessageW PeekMessageW EnumWindows IsWindowVisible GetWindowThreadProcessId CreateWindowStationW SetProcessWindowStation CreateDesktopW GetThreadDesktop SetThreadDesktop CloseWindowStation CharLowerW wvsprintfW wsprintfW MessageBoxW

advapi32

GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorControl GetLengthSid CopySid IsValidSid GetSidSubAuthority InitializeSid GetSidLengthRequired SetSecurityDescriptorDacl AddAce InitializeAcl GetAclInformation InitializeSecurityDescriptor MakeAbsoluteSD OpenProcessToken GetTokenInformation SetSecurityDescriptorOwner SetSecurityDescriptorGroup GetAce MakeSelfRelativeSD GetSecurityDescriptorLength EqualSid SetNamedSecurityInfoW ConvertStringSidToSidW OpenThreadToken RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid SetSecurityDescriptorSacl GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids TraceEvent SetTokenInformation

ole32

CoCreateGuid StringFromGUID2

shell32

SHGetFolderPathW

netapi32

NetApiBufferFree NetWkstaGetInfo

rpcrt4

UuidCreate

shlwapi

PathRemoveExtensionW PathRemoveFileSpecW PathStripPathW PathCanonicalizeW PathIsRelativeW SHQueryValueExW PathAppendW

userenv

UnloadUserProfile

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

218KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

53bf13d2c4a5ec074dd8a8607b2b771a6ee16bf6d5caef120143f76cac083f5b

kernel32

user32

advapi32

ole32

shell32

netapi32

rpcrt4

shlwapi

userenv

version

generic