bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f

Sharing

Copy URL Twitter E-mail

General

Target
bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f
Size 2.2MB
Sample240614-158pfasapl
SHA256 bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f
MD5 88e9d2c8fb64de8664191171145ef1cc
SHA1 47f9b7ba4c2bce92deb6405b911affbdc740ed91
SHA512 02a3e9ee62cc627bea00a5435e672da1b792f4d2b573d4cfedb55003aae2bda164408c1f78d164e8f4abc4aecfd83428cc93679dafb69a4a312a66652b43176d
SSDEEP 49152:PofH48nDdmXA2eelCmVQjvvmwXmqm7NrfOPCx309QTQ8N:PofH48DdCAReQIQTmw47Nrfb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f

File Explorer

bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f

.exe 2.2MB

bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f

IMPHASH d7de98cfb332cd62e34c0ee27b341a67
SHA256 bd2793d5095318d89cb0a2c4a1bb09f6c56a9ba3253c12f907b1febe4283a04f
MD5 88e9d2c8fb64de8664191171145ef1cc
SHA1 47f9b7ba4c2bce92deb6405b911affbdc740ed91
SHA512 02a3e9ee62cc627bea00a5435e672da1b792f4d2b573d4cfedb55003aae2bda164408c1f78d164e8f4abc4aecfd83428cc93679dafb69a4a312a66652b43176d
SSDEEP 49152:PofH48nDdmXA2eelCmVQjvvmwXmqm7NrfOPCx309QTQ8N:PofH48DdCAReQIQTmw47Nrfb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

120635

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetFileSize WriteFile ReadFile FindClose lstrcpyW GetTempPathW CreateFileW GetFileAttributesW GetFileAttributesExW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW GetTickCount DecodePointer HeapReAlloc HeapSize RaiseException GetLastError InitializeCriticalSectionAndSpinCount MultiByteToWideChar WideCharToMultiByte CreateDirectoryW ReleaseMutex CreateMutexW GetVolumeInformationW GetVersionExW GetLongPathNameW FileTimeToSystemTime GetPrivateProfileIntW GlobalFree OpenProcess GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeviceIoControl OutputDebugStringA SetPriorityClass GetTempFileNameW EncodePointer RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW ExitProcess GetModuleHandleExW GetStdHandle GetACP GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler OutputDebugStringW SetStdHandle GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation FlushFileBuffers WriteConsoleW SetEndOfFile GetSystemDirectoryW LoadLibraryW CreateEventW CloseHandle Sleep WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateThread IsBadReadPtr LoadLibraryA GetNativeSystemInfo SetLastError GetProcessHeap HeapFree HeapAlloc VirtualProtect IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetFullPathNameW LoadLibraryExW VirtualFree VirtualAlloc GetProcAddress FreeLibrary GetModuleFileNameW WritePrivateProfileStringW GlobalAlloc GetPrivateProfileStringW GetCurrentDirectoryW SetConsoleMode ReadConsoleInputA SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread SystemTimeToFileTime GetSystemTime GlobalMemoryStatus FlushConsoleInputBuffer FormatMessageA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA VerifyVersionInfoA QueryPerformanceFrequency GetSystemDirectoryA GetModuleHandleA VerSetConditionMask SleepEx GetFileAttributesExA

advapi32

CryptReleaseContext CryptDestroyHash CryptSignHashA CryptEnumProvidersA DuplicateTokenEx SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExW RegOpenKeyW RegEnumKeyW RegCreateKeyExW OpenProcessToken ImpersonateLoggedOnUser RevertToSelf DeregisterEventSource RegisterEventSourceA ReportEventA CryptAcquireContextA CryptCreateHash CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt RegCloseKey RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHGetFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW

user32

LoadStringW MessageBoxA GetUserObjectInformationW GetProcessWindowStation wsprintfW

ole32

CoCreateInstance CoUninitialize CoInitialize

iphlpapi

GetAdaptersInfo

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

ws2_32

__WSAFDIsSet socket WSAGetLastError getservbyname gethostbyname select WSASetLastError send bind closesocket htonl connect getpeername getsockname getsockopt htons ntohs setsockopt WSAIoctl WSAStartup getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname recv WSACleanup shutdown

wldap32

ord41 ord26 ord50 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord60 ord211 ord46 ord143 ord217 ord22

wininet

HttpQueryInfoW InternetReadFile InternetSetOptionW InternetQueryOptionW InternetOpenW InternetCloseHandle InternetOpenUrlW

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

401KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

46KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

141KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=2, id=261, version=23013,

count=18, id=241, version=40116,

count=199, id=243, version=40116,

count=30, id=242, version=40116,

count=8, id=265, version=24210,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=620, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=199, version=41118,

count=26, id=259, version=24123,

count=61, id=261, version=24123,

count=36, id=260, version=24123,

count=17, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=29, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=326, id=1, productName=Unmarked objects,

count=49, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,