9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b

Sharing

Copy URL Twitter E-mail

General

Target
9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b
Size 51KB
Sample240603-nls4eseb48
SHA256 9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b
MD5 38496cf22cba57c6822e4773343e032a
SHA1 2fa322d720e55b241067e0c0e8df6280dd3d0525
SHA512 a80b48996c7e16b2686921def59e1ef634730ccbd553956024e319323b750560e04b7f1bf3f02fe7ac796749bd5043753c6c822eac4ce433fb0b61264dc69f81
SSDEEP 768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezzsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOB4pMC6H
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b

File Explorer

9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b

.dll 51KB

9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b

IMPHASH f236a131b60c8836f355f0f113c1d2a8
SHA256 9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b
MD5 38496cf22cba57c6822e4773343e032a
SHA1 2fa322d720e55b241067e0c0e8df6280dd3d0525
SHA512 a80b48996c7e16b2686921def59e1ef634730ccbd553956024e319323b750560e04b7f1bf3f02fe7ac796749bd5043753c6c822eac4ce433fb0b61264dc69f81
SSDEEP 768:3Er7XR1M6t6FikUE58ozVOB+6QcXn0cE5Y18BtrEZJjuSkwFOBezzsAMC6Hh4:3EXXM2HEhzVWKtrEZFxFOB4pMC6H
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetTickCount ReadFile GetFileAttributesA LocalFree LocalSize LocalAlloc WinExec lstrcatA GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CreateToolhelp32Snapshot CopyFileA GetModuleFileNameA GlobalMemoryStatusEx WaitForSingleObject GetCurrentDirectoryA FreeConsole VirtualProtect HeapFree GetProcessHeap HeapAlloc InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateThread WritePrivateProfileStringA GetSystemDirectoryA GetPrivateProfileStringA lstrcmpiA SetEvent CreateEventA VirtualAlloc InterlockedExchange GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent lstrcpyA lstrlenA GetLastError GetFileSize CreateFileA SetFilePointer WriteFile CloseHandle Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess InterlockedCompareExchange EncodePointer DecodePointer VirtualFree

user32

wsprintfA GetSystemMetrics ChangeDisplaySettingsA GetLastInputInfo GetWindowThreadProcessId

advapi32

RegSetValueExA RegOpenKeyExA CloseServiceHandle OpenSCManagerA OpenServiceA QueryServiceStatus ControlService RegCloseKey

shell32

SHGetSpecialFolderPathA

oleaut32

VariantInit VariantClear

msvcr100

??2@YAPAXI@Z memcpy _CxxThrowException memset _local_unwind4 strrchr strstr ??_U@YAPAXI@Z strncpy ??_V@YAXPAX@Z free malloc printf rand atoi strcspn wcstombs realloc _errno strchr _beginthreadex _except_handler4_common _unlock __dllonexit _lock _onexit _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __clean_type_info_names_internal ??3@YAXPAX@Z ceil _strupr _stricmp __CxxFrameHandler3 _strnicmp

ws2_32

recvfrom getpeername accept listen htons getsockname inet_addr gethostbyname closesocket WSAStartup connect WSACleanup ntohs inet_ntoa select __WSAFDIsSet recv send sendto socket bind

iphlpapi

GetIfTable GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

9c4faca8e8b8ce642b1e424f122a9c8ce06d9f16dec09ab49097ee5013e3b85b

kernel32

user32

advapi32

shell32

oleaut32

msvcr100

ws2_32

iphlpapi

generic