c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

Sharing

Copy URL Twitter E-mail

General

Target
c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4
Size 1.4MB
Sample240612-eqft8a1akk
SHA256 c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4
MD5 7df1032833eb2952148fe2aaefa752bd
SHA1 f17575b3311b07e1aca581f94d4b2f950fb026f1
SHA512 25576b23ded9eded97f193782469c43e327cd1f0cd11baffb29c4d37a17b4a1e839d3459d31a8422d75d916d017df3d4a3a9c6781cf5e2736752d1a8ae2fbb0a
SSDEEP 24576:zM5gCsob142dCxxG1kgrMhWvOWJ6pB4qcwfUEWWgS8kXxKbzuoJqrars5SERlGqM:zMmCnu2dC7G1kgr3vOWJ6pPcw/WdDkBI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

File Explorer

c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

.dll 1.4MB

c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

IMPHASH 1b1cfaeaf7326ffa6c77e000dabffc53
SHA256 c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4
MD5 7df1032833eb2952148fe2aaefa752bd
SHA1 f17575b3311b07e1aca581f94d4b2f950fb026f1
SHA512 25576b23ded9eded97f193782469c43e327cd1f0cd11baffb29c4d37a17b4a1e839d3459d31a8422d75d916d017df3d4a3a9c6781cf5e2736752d1a8ae2fbb0a
SSDEEP 24576:zM5gCsob142dCxxG1kgrMhWvOWJ6pB4qcwfUEWWgS8kXxKbzuoJqrars5SERlGqM:zMmCnu2dC7G1kgr3vOWJ6pPcw/WdDkBI
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

470016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\WorkshopAgent\DevelopProj2\SDModule\Branches\Inner\V4PreRelease\Bin\Release\SDAgent64.pdb

kernel32

GetExitCodeProcess MulDiv MultiByteToWideChar MoveFileA GetUserDefaultLangID FreeLibrary GetVersion GetSystemDefaultLangID ResetEvent WaitForSingleObject WideCharToMultiByte GetProfileStringA GetPrivateProfileStringA LoadLibraryW SetUnhandledExceptionFilter SetErrorMode SetProcessShutdownParameters CompareFileTime SetCurrentDirectoryW GetCurrentDirectoryW CreateMutexW OpenMutexW GetFileSize SetEvent OpenEventA CreateEventA WaitForMultipleObjects ReleaseSemaphore CreateSemaphoreA GetComputerNameA GetComputerNameW GetProcessTimes GetFileAttributesW CreateDirectoryW CreateDirectoryA GetFileAttributesExA GetFileAttributesExW GetVolumeInformationW ReadFile CopyFileA SetFileAttributesW lstrcmpW RemoveDirectoryW DeleteFileW MoveFileExW SetFileAttributesA lstrcmpA RemoveDirectoryA CreateFileW FileTimeToSystemTime CopyFileW GetDiskFreeSpaceExW GetFileTime SetFileTime GetProcessHeap HeapAlloc QueryDosDeviceW GetDriveTypeA DefineDosDeviceA GetDiskFreeSpaceExA SetVolumeLabelA GetVolumeInformationA VirtualProtect IsBadReadPtr SetEnvironmentVariableA CompareStringW WriteConsoleW SetStdHandle SetConsoleCtrlHandler HeapReAlloc IsValidLocale HeapFree VirtualQuery CreateProcessW WriteFile FlushFileBuffers DeleteFileA MoveFileExA GetSystemInfo FindFirstFileW FindNextFileW FindFirstFileA FindNextFileA FindClose CreateThread GetModuleHandleW GetFileInformationByHandle GetCurrentThreadId GetFileAttributesA GetWindowsDirectoryA QueryDosDeviceA GetDriveTypeW GetModuleFileNameA GetCommandLineA GetTickCount CreateFileA GetSystemDirectoryA Sleep DeviceIoControl OpenMutexA OpenProcess LocalFree GetCurrentProcess DuplicateHandle CloseHandle GetModuleHandleA LoadLibraryA GetProcAddress GetLastError GetCurrentProcessId GetLogicalDrives EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP FatalAppExitA GetTimeZoneInformation GetLocaleInfoW GetStringTypeW QueryPerformanceCounter HeapDestroy HeapCreate HeapSetInformation GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW LoadResource FindResourceExA lstrlenA lstrlenW GetVersionExA FormatMessageA GetACP FormatMessageW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SleepEx CreateMutexA ReleaseMutex PulseEvent SuspendThread TerminateThread ResumeThread SetThreadPriority GetExitCodeThread FileTimeToLocalFileTime SetLastError MoveFileW CreateProcessA GetModuleFileNameW TerminateProcess SetPriorityClass GetPriorityClass GetThreadPriority VirtualQueryEx GetCurrentDirectoryA GetSystemDirectoryW GetTempPathA GetTempPathW GetEnvironmentVariableA GetEnvironmentVariableW ExpandEnvironmentStringsA ExpandEnvironmentStringsW UnmapViewOfFile MapViewOfFile CreateFileMappingA OpenFileMappingA SetFilePointer LocalAlloc OutputDebugStringW FreeConsole WriteConsoleA GetStdHandle AllocConsole GetLocalTime RtlLookupFunctionEntry RtlUnwindEx GetSystemTimeAsFileTime EncodePointer DecodePointer RaiseException RtlPcToFileHeader FlsSetValue GetDateFormatA GetTimeFormatA UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCPInfo GetOEMCP IsValidCodePage FlsGetValue FlsFree GetCurrentThread FlsAlloc LCMapStringW HeapSize ExitProcess SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType SetEndOfFile

user32

SetThreadDesktop GetThreadDesktop OpenDesktopA FindWindowExA GetWindowThreadProcessId FindWindowA CloseDesktop MsgWaitForMultipleObjects PostThreadMessageA PeekMessageA GetMessageA TranslateMessage DispatchMessageA GetDesktopWindow EnumChildWindows EnumWindows GetWindowLongA EnumDesktopWindows GetClassNameW IsWindowVisible CreateWindowExA wsprintfA GetSystemMetrics SystemParametersInfoA EnumWindowStationsA EnumDesktopsA GetUserObjectInformationW GetClientRect SendMessageA GetForegroundWindow AttachThreadInput ShowWindow GetWindowLongPtrA SetWindowPos SetForegroundWindow GetWindowTextW GetWindowTextA GetParent SendMessageTimeoutA MessageBoxW MessageBoxA OpenWindowStationA SetProcessWindowStation CloseWindowStation GetProcessWindowStation GetUserObjectInformationA OpenInputDesktop

gdi32

CreateDCW GetStockObject GetObjectW GetDeviceCaps CreateFontIndirectW DeleteDC DeleteObject GetBitmapBits BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC

advapi32

GetSecurityDescriptorDacl InitializeSecurityDescriptor GetAclInformation GetLengthSid InitializeAcl GetAce AddAce AddAccessAllowedAce SetSecurityDescriptorDacl LookupAccountNameW GetUserNameA GetFileSecurityW SetFileSecurityW GetFileSecurityA SetFileSecurityA RegSetValueExA RegOpenKeyA LookupAccountSidA LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegQueryValueExA RegCloseKey OpenSCManagerA OpenServiceA QueryServiceConfigA ChangeServiceConfigA CloseServiceHandle OpenProcessToken DuplicateTokenEx GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid RegConnectRegistryA RegOpenKeyExA RegCreateKeyExA RegQueryValueExW RegDeleteKeyA RegEnumKeyA RegQueryInfoKeyA RegDeleteValueA RegSetValueExW RegEnumValueA RegSetKeySecurity LookupAccountSidW RegCreateKeyW RegCreateKeyExW QueryServiceStatus RegOpenKeyW DeregisterEventSource ReportEventW RegisterEventSourceW

shell32

SHChangeNotify SHGetPathFromIDListW

ole32

CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

oleaut32

SystemTimeToVariantTime DosDateTimeToVariantTime

mpr

WNetGetConnectionW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mpr

version

generic