436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321

Sharing

Copy URL Twitter E-mail

General

Target
436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321
Size 3.0MB
Sample240610-c2t5wabe47
SHA256 436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321
MD5 5751dfe3132b6014b86b932277d828f4
SHA1 04f1891908dc3255cc321359ba68d34bd07b8d2c
SHA512 0406882eb0d4e311bbb9daabdf59f6f4f292a5285df22ad3a10ddf853a974d3bac40493e5e0b0015121be8f010a650a75510d6b8bcb0d235a174751db37c861e
SSDEEP 49152:D6lhxiv21qo5iNYhPLop1exIoszDVKbYTyxIapoVe:DKULo5ieho1bXDVGxJpo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321

File Explorer

436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321

.exe 3.0MB

436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321

IMPHASH 16481d60bf8fc8ab514a1cfc4ca143c6
SHA256 436c10bd50b9ef6b557688e78f0385e6bcf805ba39c9187669ad0831a1f72321
MD5 5751dfe3132b6014b86b932277d828f4
SHA1 04f1891908dc3255cc321359ba68d34bd07b8d2c
SHA512 0406882eb0d4e311bbb9daabdf59f6f4f292a5285df22ad3a10ddf853a974d3bac40493e5e0b0015121be8f010a650a75510d6b8bcb0d235a174751db37c861e
SSDEEP 49152:D6lhxiv21qo5iNYhPLop1exIoszDVKbYTyxIapoVe:DKULo5ieho1bXDVGxJpo
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

191158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

IsWindowVisible DrawTextW SystemParametersInfoA CharLowerBuffW MapVirtualKeyA UpdateLayeredWindow IsMenu IsWindowEnabled CreatePopupMenu DestroyMenu GetMenuItemCount AppendMenuW TrackPopupMenu GetMenuInfo SetMenuInfo GetMenuItemInfoW SetMenuContextHelpId AnimateWindow TrackMouseEvent GetMonitorInfoW MonitorFromWindow GetWindow GetParent SetWindowLongW SetRect ClientToScreen PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadImageW CreateIconFromResource LoadBitmapW GetSystemMetrics CallNextHookEx UnhookWindowsHookEx MapWindowPoints GetWindowRect GetClientRect SetWindowsHookExW GetDlgItem SetWindowPos CreateWindowExW RegisterClassExW CallWindowProcW DefWindowProcW GetWindowLongW GetFocus SetFocus DestroyIcon CharNextW PtInRect EqualRect IsRectEmpty UnionRect IntersectRect CopyRect SetCursor KillTimer SetTimer DestroyWindow IsWindow DestroyCursor LoadCursorW SetForegroundWindow UnregisterClassW GetKeyState GetIconInfo DrawIconEx OffsetRect InflateRect ReleaseDC GetDC GetClassNameW ScreenToClient GetCursorPos InvalidateRect EndPaint BeginPaint UpdateWindow ReleaseCapture SetCapture SystemParametersInfoW GetCapture IsZoomed IsIconic GetSysColor GetActiveWindow EnableMenuItem SendMessageW SetWindowTextW ShowWindow PostQuitMessage SetLayeredWindowAttributes PostMessageW

ole32

CreateBindCtx OleLockRunning CoCreateGuid CoUninitialize CoCreateInstance CLSIDFromProgID CLSIDFromString OleUninitialize OleInitialize CreateStreamOnHGlobal CoInitialize

shlwapi

StrToIntExW PathFileExistsW

gdiplus

GdipFree GdipImageGetFrameCount GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipGraphicsClear GdipSaveImageToFile GdipDrawImageI GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdiplusStartup GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdiplusShutdown GdipCloneImage GdipAlloc

gdi32

CreatePen CreateSolidBrush GetStockObject Rectangle SetBkMode SetTextColor CreateFontIndirectW GetDeviceCaps CreateBitmap EnumFontsW StretchBlt GetCurrentObject GetViewportOrgEx BitBlt RemoveFontMemResourceEx EnumFontFamiliesExW GetCharABCWidthsW CreateCompatibleDC DeleteDC DeleteObject ExtCreateRegion IntersectClipRect SelectClipRgn SelectObject SetGraphicsMode SetWorldTransform CreateDIBSection GetObjectW SetViewportOrgEx GetFontData SetTextAlign GetTextMetricsW ExtTextOutW GetTextFaceW GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GetGlyphIndicesW GetTextExtentPointI AddFontMemResourceEx GdiFlush

kernel32

GetTempPathW CreateFileW DeleteFileW GetLastError MultiByteToWideChar QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW ReleaseMutex CreateMutexW CreateDirectoryW FindFirstFileW WriteFile FindClose lstrcpyW FindNextFileW CreateThread MoveFileExW FreeLibrary GetProcAddress GlobalFree LocalAlloc LocalFree OpenProcess WaitForSingleObject LoadLibraryW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTickCount DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection CloseHandle FileTimeToSystemTime GetLongPathNameW GetSystemInfo FormatMessageW GetVersionExW FlushInstructionCache HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection FreeResource LockResource SetLastError LoadResource SizeofResource FindResourceW GetFullPathNameW GetLocalTime GetVersionExA GetSystemTime LoadLibraryA GetModuleHandleA SetCurrentDirectoryW GetModuleHandleW GetModuleFileNameW WideCharToMultiByte OutputDebugStringA GlobalUnlock GlobalLock GlobalAlloc MulDiv InterlockedDecrement InterlockedIncrement SetStdHandle GetConsoleCP GetTimeZoneInformation FlushFileBuffers WriteConsoleW SetEndOfFile CreateEventW InterlockedCompareExchange GetFileInformationByHandle GetFileSizeEx SetEnvironmentVariableA MapViewOfFile UnmapViewOfFile CreateFileMappingW lstrlenA VirtualAlloc SetEvent ResetEvent SleepEx GetSystemDirectoryA ReadFile GetFileSize Sleep WaitForMultipleObjects PeekNamedPipe ExpandEnvironmentStringsW GetDriveTypeW SystemTimeToTzSpecificLocalTime ExitThread FreeLibraryAndExitThread GetCurrentDirectoryW CopyFileW EncodePointer RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW GetACP GetStringTypeW GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx OutputDebugStringW WaitForSingleObjectEx FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW

advapi32

RegSetValueExW RegCloseKey RegCreateKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupAccountSidW DuplicateTokenEx RevertToSelf ImpersonateLoggedOnUser RegEnumKeyW RegOpenKeyW RegOpenKeyExW

shell32

ShellExecuteW ShellExecuteExW SHGetSpecialFolderPathW SHGetFolderPathW

imm32

ImmAssociateContext ImmGetContext ImmDestroyContext ImmCreateContext ImmReleaseContext

oleaut32

SysFreeString SysAllocString

ws2_32

gethostbyaddr inet_ntoa inet_addr htonl WSASetLastError setsockopt ntohs htons getsockopt gethostbyname getpeername connect bind send recv WSAGetLastError socket closesocket WSACleanup WSAStartup getservbyport getservbyname select __WSAFDIsSet recvfrom sendto accept listen ioctlsocket gethostname getsockname

usp10

ScriptShape ScriptItemize ScriptFreeCache

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

484KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

60KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

519KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=261, version=23013,

count=37, id=241, version=40116,

count=201, id=243, version=40116,

count=39, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=199, version=41118,

count=27, id=259, version=24123,

count=8, id=264, version=24215,

count=79, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=461, id=1, productName=Unmarked objects,

count=25, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=65, id=261, version=24123,

count=40, id=260, version=24123,

count=494, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,