4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573

Sharing

Copy URL Twitter E-mail

General

Target
4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573
Size 1.3MB
Sample240612-e7zcws1cpq
SHA256 4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573
MD5 db9f1195ae3bee7d7104060e018fe558
SHA1 5a67d1a274aac4983caf5ea79ed70625cdda960d
SHA512 b6861feb3d9dd4b9971e0b48563572371f6aa871d40ea69f45782676612cd6e6eb8827614969d4b23f72a6d7af0aaa0aec9bbe8e9baca3dc99c608909e332f67
SSDEEP 24576:ycyvw2M/r6mEusqK01BooooEbiiIHBlPa1GJdO+eUBP1S14e4uP4ND:yhOrzE6ooooECK1GJdO+eiP1SOe43ND
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573

File Explorer

4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573

.exe 1.3MB

4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573

IMPHASH 46c8dee621ff737948aafe8f34fa5716
SHA256 4ec66f5eb55bbef1de0266ed29d46595eaf938c9acce1557b4fae8ad1a017573
MD5 db9f1195ae3bee7d7104060e018fe558
SHA1 5a67d1a274aac4983caf5ea79ed70625cdda960d
SHA512 b6861feb3d9dd4b9971e0b48563572371f6aa871d40ea69f45782676612cd6e6eb8827614969d4b23f72a6d7af0aaa0aec9bbe8e9baca3dc99c608909e332f67
SSDEEP 24576:ycyvw2M/r6mEusqK01BooooEbiiIHBlPa1GJdO+eUBP1S14e4uP4ND:yhOrzE6ooooECK1GJdO+eiP1SOe43ND
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

308816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb

shell32

SHGetFolderPathW

ntdll

RtlNtStatusToDosError VerSetConditionMask RtlUnwind

kernel32

CreateProcessW WaitForSingleObject GetExitCodeProcess VerifyVersionInfoW GetPriorityClass GetProcessTimes K32GetProcessMemoryInfo CreateEventW SetEvent ResetEvent CreateSemaphoreW ReleaseSemaphore GetSystemInfo GetVersionExW QueryPerformanceCounter ExpandEnvironmentStringsW GetModuleFileNameW GetFileAttributesW LoadLibraryExW GetWindowsDirectoryW GetSystemDirectoryW DeviceIoControl VirtualAlloc VirtualFree VirtualProtect HeapDestroy HeapReAlloc GlobalMemoryStatusEx WaitForMultipleObjects TerminateThread GetExitCodeThread TlsFree SetFilePointer SetEndOfFile MoveFileExW LockFileEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetFileAttributesExW FindFirstFileW FindClose CreateDirectoryW RemoveDirectoryW FindFirstFileExW FindNextFileW QueryDosDeviceW GetEnvironmentVariableW WriteConsoleW K32GetMappedFileNameW CopyFileW SetFileInformationByHandle GetFileSizeEx GetDiskFreeSpaceExW FindResourceW LoadResource LockResource SizeofResource GetVolumePathNameW GetVolumeNameForVolumeMountPointW FindFirstVolumeW FindNextVolumeW GetVolumePathNamesForVolumeNameW FindVolumeClose VirtualQuery GetSystemTimes SetFilePointerEx GetTickCount64 RaiseException GetConsoleOutputCP GetStdHandle GetCommandLineA GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread InterlockedPushEntrySList OutputDebugStringW K32GetProcessImageFileNameW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList FreeLibrary LocalFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId ReadConsoleW GetSystemTimeAsFileTime FileTimeToSystemTime OutputDebugStringA GetFullPathNameW ReadFile GetFileInformationByHandle DeleteFileW LeaveCriticalSection EnterCriticalSection FlushFileBuffers GetLastError WriteFile CreateFileW SetLastError Sleep DeleteCriticalSection InitializeCriticalSection CompareStringW GetModuleHandleW GetProcessHeap GetProcAddress HeapAlloc GetCurrentThreadId GetModuleHandleExW HeapFree GetUserDefaultUILanguage GetCommandLineW GetCurrentProcess InitializeCriticalSectionEx WideCharToMultiByte MultiByteToWideChar CloseHandle GetConsoleMode LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetFileAttributesW UnlockFileEx FindResourceExW HeapSize GetVersion GlobalUnlock GlobalLock GlobalAlloc CreateThread GetStartupInfoW IsDebuggerPresent InitializeSListHead TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount LoadLibraryExA HeapSetInformation IsProcessorFeaturePresent ExitProcess lstrcpyW SetDllDirectoryW GlobalFree GetTimeZoneInformation LoadLibraryW GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx LCMapStringEx EncodePointer DecodePointer GetCPInfo

user32

MessageBoxW PostMessageW GetSystemMetrics CharLowerW SetWindowLongW GetWindowLongW DefWindowProcW SystemParametersInfoW LoadImageW CreateWindowExW SendMessageW SetWindowPos SetFocus DestroyWindow PostQuitMessage DestroyIcon GetDC ReleaseDC GetMessageW IsDialogMessageW TranslateMessage DispatchMessageW LoadIconW EndPaint BeginPaint InvalidateRect UpdateWindow RegisterWindowMessageW KillTimer DrawTextW SetTimer MoveWindow LoadCursorW IsWindow ShowWindow SetWindowTextW UnregisterClassW GetClassInfoExW RegisterClassExW

advapi32

GetTokenInformation IsValidSid GetSidSubAuthority GetSidSubAuthorityCount DuplicateTokenEx CryptReleaseContext CryptGenRandom CryptAcquireContextW RegCloseKey RegQueryValueExW RegOpenKeyExW LookupAccountSidW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateProcessAsUserW OpenProcessToken

comctl32

ord17

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipLoadImageFromStream GdipGetPropertyItemSize GdipDeleteGraphics GdipImageGetFrameCount GdipCreateFromHDC GdipImageGetFrameDimensionsList GdiplusStartup GdiplusShutdown GdipImageGetFrameDimensionsCount GdipCloneImage GdipImageSelectActiveFrame GdipFree GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipGetPropertyItem

shlwapi

PathMatchSpecW

gdi32

SelectObject DeleteObject GetTextExtentPoint32W SetBkMode SetTextColor DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontIndirectW

ole32

CoCreateInstance CreateStreamOnHGlobal

Name

.text

Size

909KB

Virtual Size

909KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=17, id=259, version=29395,

count=190, id=261, version=29395,

count=2, id=253, version=31823,

count=19, id=260, version=31823,

count=24, id=259, version=31823,

count=97, id=261, version=31823,

count=25, id=260, version=29395,

count=5, id=260, productName=VS2019 v16.4.0 build 28314, version=28314,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=261, version=30146,

count=1, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=6, productName=Unmarked objects (old),

count=1, id=263, version=29395,

count=19, id=257, version=29395,

count=430, id=1, productName=Unmarked objects,

count=146, id=265, version=31937,

count=1, id=256, version=31937,

count=1, id=255, version=31937,

count=3, id=151,

count=1, id=258, version=31937,