d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138

Sharing

Copy URL Twitter E-mail

General

Target
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138
Size 590KB
Sample240612-frrtjs1gmq
SHA256 d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138
MD5 f71d163aa086f1af61059d272bacda4e
SHA1 e7b2a92c4cd26d055d3b5ad517834a3eca08a733
SHA512 d36a078f8e58b4b64f3b98ce2781254b055dc105b0c881a3c8be424b69a2d86446d850a19633f9769480739cc6ab8cf07dcb9ffa91733b7851b1479b10d9c747
SSDEEP 12288:B7e3e7XyGF8krB3lgowVsIyePjMGD052AzCDCEjds+IHe6j8:B7e3e7XyGF1r3ksIyePjMzXeDCEjds+v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138

File Explorer

d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138

.exe 590KB

d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138

IMPHASH b425e0d73473b7ba5dd1ed1b525d825c
SHA256 d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138
MD5 f71d163aa086f1af61059d272bacda4e
SHA1 e7b2a92c4cd26d055d3b5ad517834a3eca08a733
SHA512 d36a078f8e58b4b64f3b98ce2781254b055dc105b0c881a3c8be424b69a2d86446d850a19633f9769480739cc6ab8cf07dcb9ffa91733b7851b1479b10d9c747
SSDEEP 12288:B7e3e7XyGF8krB3lgowVsIyePjMGD052AzCDCEjds+IHe6j8:B7e3e7XyGF1r3ksIyePjMzXeDCEjds+v
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

264470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

A:\Projects\reml\AnakageNext\IAssistHelper\Release\IAssistHelper.pdb

kernel32

GetModuleHandleA lstrlenA CopyFileA SetComputerNameExA FindFirstFileA FindNextFileA RemoveDirectoryA MultiByteToWideChar AllocConsole CreateFileA CloseHandle ReadFile FileTimeToLocalFileTime FileTimeToSystemTime FormatMessageA LocalAlloc LocalSize LocalFree CreatePipe SetHandleInformation CreateProcessA WaitForSingleObject GetExitCodeProcess MoveFileA LoadLibraryA FreeLibrary GlobalMemoryStatusEx GetCurrentProcess GetProcAddress Process32First Process32Next GetFileTime SystemTimeToTzSpecificLocalTime GetTickCount GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep DeleteFileA FindNextFileW FindFirstFileW FindClose GetFullPathNameW WideCharToMultiByte FindResourceExW FindResourceW GetTempPathA CreateDirectoryA GetLastError GetFileAttributesA GetModuleFileNameA SizeofResource LockResource LoadResource TerminateProcess HeapSetInformation InterlockedCompareExchange InterlockedExchange DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy CreateToolhelp32Snapshot FindResourceA IsProcessorFeaturePresent

user32

wsprintfA ShowWindow FindWindowA

winmm

timeGetTime

advapi32

RegQueryInfoKeyA InitiateSystemShutdownExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken GetUserNameA RegDeleteKeyA RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegDeleteValueA RegOpenKeyA RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueExW

shell32

ShellExecuteA SHCreateDirectoryExA ShellExecuteExA SHGetFolderPathA

ole32

CoUninitialize CoInitialize CoCreateInstance

wininet

FindFirstUrlCacheEntryA DeleteUrlCacheEntry FindCloseUrlCache FindNextUrlCacheEntryA

shlwapi

PathFindExtensionA PathRemoveFileSpecA

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_BADOFF@std@@3_JB ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Xlength_error@std@@YAXPBD@Z ?id@?$codecvt@DDH@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ??Bid@locale@std@@QAEIXZ ??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AAVios_base@2@AAHPAUtm@@PBD4@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?getloc@ios_base@std@@QBE?AVlocale@2@XZ ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ

msvcr100

memmove memcpy_s ??0exception@std@@QAE@ABV01@@Z ??2@YAPAXI@Z fgetc fputc ungetc rand _lock_file _unlock_file fwrite _fseeki64 fgetpos fsetpos setvbuf fflush memmove_s fclose ??0bad_cast@std@@QAE@PBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ ?what@exception@std@@UBEPBDXZ _localtime64_s _time64 strftime memchr free malloc mbstowcs_s ??1exception@std@@UAE@XZ _set_errno fopen fgets fputs _mbscmp strstr srand fprintf feof fgetws _wtoi _mbsstr _mbschr _mbslwr_s _mbsinc _ismbcspace strnlen _recalloc calloc _vscprintf vsprintf_s atoi _mktime64 ceil wmemcpy_s _vsnprintf mbstowcs printf _mbsrchr strcpy_s memset __CxxFrameHandler3 ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _amsg_exit __getmainargs _cexit _exit _XcptFilter exit __initenv _initterm _initterm_e _configthreadlocale __setusermatherr _commode _fmode __set_app_type _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _invoke_watson _controlfp_s _CxxThrowException memcpy ??0exception@std@@QAE@ABQBD@Z ??3@YAXPAX@Z wcstombs_s

crypt32

CertGetNameStringA

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WinVerifyTrust WTHelperProvDataFromStateData

Sharing

General

Malware Config

Signatures

File Explorer

d294fbee117795959982ef6bff1da00135ae513801cf947090e401b126d81138

kernel32

user32

winmm

advapi32

shell32

ole32

wininet

shlwapi

msvcp100

msvcr100

crypt32

wintrust

generic