602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e

Sharing

Copy URL Twitter E-mail

General

Target
602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e
Size 10.0MB
Sample240603-kf28csae42
SHA256 602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e
MD5 15c9968d059c8bbdf22dd4685bda74fa
SHA1 16aaaa0556209774490af5adde21d3354c224a99
SHA512 8ab4ef233abe93b31dbf4cd3dfcc528df0b004eab348f1174190c222e69854276c4349f4197246a1fb1e5efeb4e124c20e895db5dee180d5e680bba22896ad12
SSDEEP 196608:MyjuPNak1I3nNLRMvnBWWAVNwHVb64z4I7nLzyBHwI2+hcIENsK:PjuP4n5RSn0LPH4MwnLWdN54
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e
unpack001/$PLUGINSDIR/System.dll

File Explorer

602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e

.exe 10.0MB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/update.patch

25.7MB

602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e

IMPHASH 6ce82fb43c0ac7da4ba1e230e17b0851
SHA256 602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e
MD5 15c9968d059c8bbdf22dd4685bda74fa
SHA1 16aaaa0556209774490af5adde21d3354c224a99
SHA512 8ab4ef233abe93b31dbf4cd3dfcc528df0b004eab348f1174190c222e69854276c4349f4197246a1fb1e5efeb4e124c20e895db5dee180d5e680bba22896ad12
SSDEEP 196608:MyjuPNak1I3nNLRMvnBWWAVNwHVb64z4I7nLzyBHwI2+hcIENsK:PjuP4n5RSn0LPH4MwnLWdN54
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress GetModuleHandleA GetSystemDirectoryW OpenProcess lstrcpyW LoadLibraryA GetVersionExW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 93a8e95708882e56250ae55aef93417333b2dbe7ea99590abed34cdca2227e61
MD5 c51fc979c1c3e17bece7bd194aeb6ea2
SHA1 9a5d000d6393f2980062b4cc6e8f543493b1be8f
SHA512 716cdeb890307ff42901464dd24aa94e29415ef20d4e975c2733e34330fdf85edfd4ad9e00878edbe98921deebe44153279cb95acb309c5e1812026716dcdc4e
SSDEEP 192:sfer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4SyYXe:sw7Xws4FVWig86/5eCBqSyYXe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

602baab3e174a495e5606300d166dc2fe54e903d93b382759859d451f9dd1c0e

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/update.patch