bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572

General

Target
bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572
Size 719KB
Sample240611-c32lca1djc
SHA256 bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572
MD5 bcbf9d2fc64727580c2f6b88f965b980
SHA1 381e0beb7ec08a8be2ce29c5c34825ab7cac0345
SHA512 b61458a57d3d911b47fa00812602c91c1bcf1f8559d7c36ac1a440ca5f651a1f315e9aaea3d01316a5566c60d826afbcf03b91ff86480538ceb585b4cdfd1287
SSDEEP 12288:Fd4V2aZv2JArDRsYoQyErEjWiB26w8CXlYiCDXfL10u5Tu0X:Fd4rZiwDRsYP7rECiBrwllYTDjuu5y0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572

File Explorer

bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572

.dll 719KB

bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572

IMPHASH 31b771c9e17039eaf870017c5fa0d436
SHA256 bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572
MD5 bcbf9d2fc64727580c2f6b88f965b980
SHA1 381e0beb7ec08a8be2ce29c5c34825ab7cac0345
SHA512 b61458a57d3d911b47fa00812602c91c1bcf1f8559d7c36ac1a440ca5f651a1f315e9aaea3d01316a5566c60d826afbcf03b91ff86480538ceb585b4cdfd1287
SSDEEP 12288:Fd4V2aZv2JArDRsYoQyErEjWiB26w8CXlYiCDXfL10u5Tu0X:Fd4rZiwDRsYP7rECiBrwllYTDjuu5y0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

700416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameW GetModuleFileNameA InterlockedDecrement WaitForSingleObject lstrlenA CloseHandle GetLastError HeapFree HeapAlloc ExitThread GetCurrentThreadId CreateThread TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetModuleHandleW Sleep GetProcAddress ExitProcess GetCommandLineA HeapReAlloc GetModuleHandleA HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc WriteFile GetStdHandle TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError LoadLibraryA InitializeCriticalSectionAndSpinCount SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime MultiByteToWideChar ReadFile GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize GetLocaleInfoA SetFilePointer SetStdHandle FlushFileBuffers CreateFileA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetEndOfFile GetProcessHeap

user32

InflateRect

gdi32

CreateRectRgn CombineRgn GetRgnBox PtInRegion DeleteObject CreatePolygonRgn CreateEllipticRgnIndirect

oleaut32

SysFreeString VariantClear SysAllocString

Name

.text

Size

341KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

291KB

Virtual Size

291KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rmnet

Size

56KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=3, id=150, version=20413,

count=34, id=149, productName=VS2008 build 21022, version=21022,

count=9, id=123, productName=VS2005 build 50727, version=50727,

count=112, id=1, productName=Unmarked objects,

count=15, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=7, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=21, id=48, version=9044,

count=7, id=49, version=9044,

count=7, id=109, productName=VS2005 build 50727, version=50727,

count=6, id=110, productName=VS2005 build 50727, version=50727,

count=67, id=132, productName=VS2008 build 21022, version=21022,

count=157, id=131, productName=VS2008 build 21022, version=21022,

count=1, id=146, productName=VS2008 build 21022, version=21022,

count=1, id=148, productName=VS2008 build 21022, version=21022,

count=1, id=145, productName=VS2008 build 21022, version=21022,

Sharing

General

Malware Config

Signatures

File Explorer

bc8f1f867b2e6c7d90ee8db77ce5e6e7bb14fabbe9cf4b53092b8915c59eb572

kernel32

user32

gdi32

oleaut32

generic