urelas | 0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831

Sharing

Copy URL Twitter E-mail

General

Target
0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831
Size 367KB
Sample240403-w6nnfaha71
SHA256 0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831
MD5 32858a4e2d877708b47298560f006f64
SHA1 967f98a8db5974ab1ac533d4c03185d5c593c3cd
SHA512 173375b0464bbf4cc4326f7fd269c23987ed0a9ba4d86b265011da9e8cc71dc2fd247984e794df8703b4b8e3da8a2bad90b165603912e27461871cece0d7c576
SSDEEP 6144:1o3whi+1Py3V0a24kOn+Sr72iyjmhuKtUYiw52hVOcvBRMHkWYHpi:YKf1PyKa2anKjm3OYZ2hocvHI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831

File Explorer

0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831

.exe 367KB

0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831

IMPHASH b6852ed4e334147c4929ea4ff7285899
SHA256 0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831
MD5 32858a4e2d877708b47298560f006f64
SHA1 967f98a8db5974ab1ac533d4c03185d5c593c3cd
SHA512 173375b0464bbf4cc4326f7fd269c23987ed0a9ba4d86b265011da9e8cc71dc2fd247984e794df8703b4b8e3da8a2bad90b165603912e27461871cece0d7c576
SSDEEP 6144:1o3whi+1Py3V0a24kOn+Sr72iyjmhuKtUYiw52hVOcvBRMHkWYHpi:YKf1PyKa2anKjm3OYZ2hocvHI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20130805)\Update_2010\bin\Update_2010.pdb

kernel32

GetFileSizeEx CloseHandle GetSystemDirectoryW GetTempPathW GetFileAttributesW GetTickCount GetLastError ReadFile SetFilePointer WriteFile FlushFileBuffers CreateFileA DeviceIoControl Sleep SetFileAttributesW DeleteFileW GetCurrentProcessId TerminateProcess GetProcAddress GetTempPathA GetModuleFileNameA SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateFileW OpenEventW CreateEventW CreateThread SetEndOfFile HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetVersionExW MultiByteToWideChar FreeResource LockResource LoadResource SizeofResource GetModuleFileNameW FindResourceW IsProcessorFeaturePresent DeleteCriticalSection GetFileType SetHandleCount GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle GetConsoleMode GetConsoleCP RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW ExitProcess InterlockedDecrement GetCurrentThreadId HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetProcessHeap

user32

LoadCursorW RegisterClassExW LoadStringW wsprintfW LoadIconW CreateWindowExW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

htonl gethostbyaddr WSAStartup socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersInfo

Name

.text

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

214KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

UGFDWSE

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0b1de20438635035c08117fdcb66f1b6807ae3ce8714c5daaf07d8ba081d7831

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

generic