urelas | 4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd

Sharing

Copy URL Twitter E-mail

General

Target
4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd
Size 487KB
Sample240403-zncd8sch38
SHA256 4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd
MD5 474974af1698e9cb38a817cbe4dc8ae7
SHA1 4b437068629034528c923ddd34ced8c9aaf53fb1
SHA512 2923adc2ba285bf896dcfbba5a142d26df2ffe8238a324a4aefbb443121d2f1615fd785b61bcfa03ab9339c18f875e041c1ec93034552d6777f69089d4d9c558
SSDEEP 12288:cpbfVlu0agWfZlnxgmEpZGsrUs99uDEq5EGDFhc:cpbGRZxSfGCUs99hq5JU
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd

File Explorer

4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd

.exe 487KB

4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd

IMPHASH 56070a768a13c1e389e8414fe16ea7da
SHA256 4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd
MD5 474974af1698e9cb38a817cbe4dc8ae7
SHA1 4b437068629034528c923ddd34ced8c9aaf53fb1
SHA512 2923adc2ba285bf896dcfbba5a142d26df2ffe8238a324a4aefbb443121d2f1615fd785b61bcfa03ab9339c18f875e041c1ec93034552d6777f69089d4d9c558
SSDEEP 12288:cpbfVlu0agWfZlnxgmEpZGsrUs99uDEq5EGDFhc:cpbGRZxSfGCUs99hq5JU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\PMS\pms4\Project(20130920)\GolfProject\bin\GolfProject.pdb

kernel32

LocalReAlloc DeleteCriticalSection GlobalFree TlsFree GetProcAddress InterlockedDecrement FreeLibrary GetCurrentProcessId lstrlenW FormatMessageW GetCurrentThreadId InterlockedIncrement lstrcmpA lstrlenA GetVersionExA lstrcmpW LoadLibraryA InitializeCriticalSection GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GlobalFlags FlushFileBuffers SetEndOfFile GetCurrentProcess GetModuleHandleA TlsSetValue HeapAlloc HeapFree GetStartupInfoW RtlUnwind RaiseException HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetConsoleCP GetConsoleMode SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree VirtualAlloc HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetProcessHeap GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock EnterCriticalSection TlsGetValue LeaveCriticalSection LocalFree LocalAlloc SetLastError TlsAlloc WideCharToMultiByte LocalFileTimeToFileTime GetCurrentDirectoryW SystemTimeToFileTime SetFilePointer GetLastError SetFileAttributesW GetFileSizeEx LockResource LoadResource SizeofResource FindResourceW GetModuleHandleW ExitProcess MultiByteToWideChar CreateThread WriteFile CreateFileA GetModuleFileNameA GetTempPathA CreateFileW ReadFile DeviceIoControl GetSystemDirectoryW GetTickCount Sleep CreateEventW CloseHandle OpenEventW DeleteFileW GetFileAttributesW GetTempPathW GetModuleFileNameW LoadLibraryW GetVersionExW

user32

DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect PostMessageW GetClassInfoExW GetClassInfoW ClientToScreen AdjustWindowRectEx GetDlgCtrlID CallWindowProcW PtInRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush SetWindowsHookExW CallNextHookEx GetKeyState PeekMessageW ValidateRect GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetWindowThreadProcessId wsprintfW LoadStringW SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx SetWindowTextW DispatchMessageW LoadIconW LoadCursorW RegisterClassExW CreateWindowExW DialogBoxParamW DestroyWindow DefWindowProcW BeginPaint EndPaint PostQuitMessage EndDialog RegisterClassW RegisterWindowMessageW CopyRect

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteA

ws2_32

gethostbyaddr htonl socket closesocket send recv gethostbyname inet_addr htons WSAStartup WSAGetLastError connect

iphlpapi

GetAdaptersInfo

oleacc

LresultFromObject CreateStdAccessibleObject

gdi32

DeleteDC GetStockObject CreateBitmap GetClipBox SetTextColor SetBkColor DeleteObject SaveDC ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetMapMode SetViewportExtEx OffsetViewportOrgEx PtVisible RestoreDC SetViewportOrgEx SelectObject Escape TextOutW ExtTextOutW GetDeviceCaps RectVisible

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

oleaut32

VariantClear VariantChangeType VariantInit

Name

.text

Size

152KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

HOHOHOH

Size

51KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

4a5c639e75a9846ea5db6a52200e29c16b1d4a8117b8fd857e5d596246894cdd

kernel32

user32

advapi32

shell32

ws2_32

iphlpapi

oleacc

gdi32

winspool.drv

oleaut32

generic