9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373

Sharing

Copy URL Twitter E-mail

General

Target
9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373
Size 1.1MB
Sample240613-chw55a1akd
SHA256 9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373
MD5 fb73bc2a9920af04fa6e0174c06bd04d
SHA1 1b95e4502086ea664dc454d9de67a8fdfe820c29
SHA512 ac680a44cfff24a2d28eb120e487d67c7e3bd10e980b346dabb62ae63e2a30b0d1af1882b43d8154e8c073de2861d57c65209bde8f1fef7d3876613c4712045e
SSDEEP 24576:hVNwLoJiIzGCcStstiClUCRyITkPM5/GfHKMwMtRm8qE1jtTuOW1:SICDCppTuZ1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373

File Explorer

9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373

.dll 1.1MB

9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373

IMPHASH 0593fde2735ecc8c5ed30bc0476c4e67
SHA256 9f4e614f8da2231e45d118ae81828e0dc85fb41d97635951bea5b6a8e58b7373
MD5 fb73bc2a9920af04fa6e0174c06bd04d
SHA1 1b95e4502086ea664dc454d9de67a8fdfe820c29
SHA512 ac680a44cfff24a2d28eb120e487d67c7e3bd10e980b346dabb62ae63e2a30b0d1af1882b43d8154e8c073de2861d57c65209bde8f1fef7d3876613c4712045e
SSDEEP 24576:hVNwLoJiIzGCcStstiClUCRyITkPM5/GfHKMwMtRm8qE1jtTuOW1:SICDCppTuZ1
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129299

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateToolhelp32Snapshot Process32Next Process32First TerminateProcess OpenProcess ExitProcess GetVersion DeviceIoControl Beep MoveFileExA CopyFileA GetModuleFileNameA GetVersionExA WinExec TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole GetWindowsDirectoryA WideCharToMultiByte MultiByteToWideChar GlobalSize QueryPerformanceFrequency QueryPerformanceCounter HeapFree GlobalMemoryStatusEx GetSystemInfo ReleaseMutex CreateMutexA GetCurrentThread GetEnvironmentVariableA GetCurrentThreadId Module32Next lstrcmpiA Module32First ResumeThread OpenThread Thread32Next Thread32First SuspendThread GetPriorityClass GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA SystemTimeToTzSpecificLocalTime lstrcpynA lstrcmpA OutputDebugStringA GetFileAttributesExA FileTimeToSystemTime MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrcatA CreateProcessA lstrcpyA CreateDirectoryA GetLastError GetProcAddress DeleteFileA GetCurrentProcess IsWow64Process SetFilePointer WriteFile GetSystemDirectoryA GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap Sleep CancelIo SetEvent ResetEvent CreateEventA LocalAlloc LocalReAlloc LocalSize LocalFree GetLocalTime GetModuleHandleA GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange WaitForSingleObject CloseHandle LoadLibraryA LoadLibraryW

user32

GetWindowLongA ShowWindow wsprintfA MessageBoxA CharNextA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState EnumWindows ExitWindowsEx SwapMouseButton GetWindowRect MoveWindow FindWindowA ChangeDisplaySettingsA GetSystemMetrics GetDC LoadCursorA DestroyCursor BlockInput ReleaseDC SystemParametersInfoA keybd_event MapVirtualKeyA mouse_event DestroyWindow SetClipboardData EmptyClipboard OpenClipboard GetClipboardData PostMessageA SetCapture WindowFromPoint SetCursorPos GetCursorPos GetCursorInfo SetRect GetDesktopWindow GetClassNameA GetWindow GetLastInputInfo PrintWindow GetTopWindow GetWindowPlacement PtInRect GetUserObjectInformationA GetThreadDesktop CloseDesktop OpenInputDesktop CreateDesktopA OpenDesktopA ChildWindowFromPoint ScreenToClient GetMenuItemID MenuItemFromPoint RealGetWindowClassA GetDlgItemTextA GetWindowTextLengthA SetWindowTextA SetDlgItemTextA SetFocus SetWindowLongA LoadIconA SetClassLongA PostQuitMessage CreateDialogIndirectParamA GetDlgItem SetWindowPos GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA SendMessageA SetThreadDesktop IsWindowVisible GetWindowThreadProcessId WaitForInputIdle CloseClipboard

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteDC DeleteObject CreateCompatibleDC CreateDIBSection SelectObject GetDeviceCaps

advapi32

GetTokenInformation LookupAccountSidA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges EnumServicesStatusA QueryServiceConfigA QueryServiceConfig2A QueryServiceStatus RegCloseKey RegOpenKeyExA GetUserNameA CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyA StartServiceA CloseServiceHandle OpenServiceA OpenSCManagerA SetServiceStatus DeleteService SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegEnumKeyExA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegQueryInfoKeyA RegCreateKeyExA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase ControlService

shell32

ShellExecuteExA SHAppBarMessage SHGetFolderPathA SHGetFileInfoA SHGetSpecialFolderPathA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysFreeString

mfc42

ord5440 ord6282 ord5710 ord535 ord536 ord939 ord6876 ord3663 ord1140 ord926 ord924 ord4202 ord2818 ord6143 ord354 ord5186 ord4204 ord2915 ord5442 ord5572 ord6874 ord2764 ord1979 ord665 ord356 ord858 ord537 ord922 ord2770 ord2781 ord4058 ord3178 ord1980 ord4215 ord3324 ord3310 ord3010 ord3304 ord3181 ord941 ord6883 ord668 ord2614 ord3811 ord860 ord800 ord541 ord540 ord801 ord825 ord823 ord4278 ord6662 ord4129 ord2784 ord6283 ord940 ord5450 ord6394 ord6383 ord2763

msvcrt

strchr tolower _iob memcmp _CxxThrowException strcat _stricmp _except_handler3 strrchr _strlwr wcsstr rand system _splitpath strncpy memcpy strncat realloc atoi ??1type_info@@UAE@XZ __dllonexit _onexit _initterm _adjust_fdiv __CxxFrameHandler memmove ceil _ftol strlen strstr wcslen fabs sprintf strcmp free malloc strncmp pow strcpy atol floor _wcsupr _strcmpi _itoa _access _strnicmp exit fprintf sscanf getenv vsprintf wcscpy

msvcp60

??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ?_Xran@std@@YAXXZ ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1_Winit@std@@QAE@XZ

winmm

waveInGetNumDevs mciSendStringA

ws2_32

getsockname inet_addr ntohs inet_ntoa send select WSAStartup WSAIoctl closesocket gethostname WSACleanup setsockopt connect htons gethostbyname socket recv

iphlpapi

GetIfTable

dwmapi

ord102 DwmIsCompositionEnabled

shlwapi

StrStrA PathGetArgsA PathRemoveArgsA PathUnquoteSpacesA SHDeleteKeyA PathFindFileNameA

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wininet

InternetConnectA InternetGetConnectedState InternetOpenA InternetCloseHandle HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile

wtsapi32

WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

552KB

Virtual Size

551KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

264KB

Virtual Size

263KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

493KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

56KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=6, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=58, id=48, version=9044,

count=75, productName=Unmarked objects (old),

count=1, id=11, version=8047,

count=4, id=10, version=8047,

count=4, id=4, version=8047,

count=7, id=12, version=7291,

count=8, id=14, version=7299,

count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=2, id=4, version=9782,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=480, id=1, productName=Unmarked objects,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=37, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,