3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40

Sharing

Copy URL Twitter E-mail

General

Target
3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40
Size 51KB
Sample240528-sbc2nshf4v
SHA256 3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40
MD5 083f36c39ebd2ee19760ae30dc5e1bca
SHA1 8608183b94d1b3d15c328b29cf390ecb3719fe2e
SHA512 25e135335a0502a0275be006cda5763ffeeb7aa3a7b768e63587c9b81dcc0669d6011bb00b33be63e690f52d2bb5e52cb37e0219ef484a58bc079fda45c66c8c
SSDEEP 768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezBsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBypMC6H
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40

File Explorer

3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40

.dll 51KB

3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40

IMPHASH f236a131b60c8836f355f0f113c1d2a8
SHA256 3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40
MD5 083f36c39ebd2ee19760ae30dc5e1bca
SHA1 8608183b94d1b3d15c328b29cf390ecb3719fe2e
SHA512 25e135335a0502a0275be006cda5763ffeeb7aa3a7b768e63587c9b81dcc0669d6011bb00b33be63e690f52d2bb5e52cb37e0219ef484a58bc079fda45c66c8c
SSDEEP 768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezBsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOBypMC6H
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetTickCount ReadFile GetFileAttributesA LocalFree LocalSize LocalAlloc WinExec lstrcatA GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot CopyFileA GetModuleFileNameA GlobalMemoryStatusEx WaitForSingleObject GetCurrentDirectoryA FreeConsole VirtualProtect HeapFree GetProcessHeap HeapAlloc InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateThread WritePrivateProfileStringA GetSystemDirectoryA GetPrivateProfileStringA lstrcmpiA SetEvent CreateEventA VirtualAlloc InterlockedExchange GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent lstrcpyA lstrlenA GetLastError GetFileSize CreateFileA SetFilePointer WriteFile CloseHandle Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess InterlockedCompareExchange EncodePointer DecodePointer VirtualFree

user32

wsprintfA GetSystemMetrics ChangeDisplaySettingsA GetLastInputInfo GetWindowThreadProcessId

advapi32

RegSetValueExA RegOpenKeyExA CloseServiceHandle OpenSCManagerA OpenServiceA QueryServiceStatus ControlService RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit VariantClear

msvcr100

??2@YAPAXI@Z memcpy _CxxThrowException memset _local_unwind4 strrchr strstr ??_U@YAPAXI@Z strncpy ??_V@YAXPAX@Z free malloc printf rand atoi strcspn wcstombs realloc _errno strchr _beginthreadex _except_handler4_common _unlock __dllonexit _lock _onexit _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __clean_type_info_names_internal ??3@YAXPAX@Z ceil _strupr _stricmp __CxxFrameHandler3 _strnicmp

ws2_32

recvfrom getpeername accept listen htons getsockname inet_addr gethostbyname closesocket WSAStartup connect WSACleanup ntohs inet_ntoa select __WSAFDIsSet recv send sendto socket bind

iphlpapi

GetIfTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

3be2abee1a119d0d4dd39a80d163cccf1d997126218681a27c81ac68356a4b40

kernel32

user32

advapi32

shell32

oleaut32

msvcr100

ws2_32

iphlpapi

generic