afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d

Sharing

Copy URL Twitter E-mail

General

Target
afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d
Size 233KB
Sample240621-cvbd7azenn
SHA256 afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d
MD5 714f3a3828aad4941a944d21e72240a7
SHA1 09e0e6a9c8d7fc018378dd1d5129be180c34facc
SHA512 66eff5afcfe97955283f9106bddda6df9c93543491d99244ecd9ae0f56fab0e89a6355964824e3e82bf0a2eb17d11e01a74ada1c44e84567cac4a5f0cb4172bb
SSDEEP 6144:xFhw85cgrrdSV1U773PfeUVS8hbQzX4DT3OKNz:x3nVhSV1U33P2UVbBAWz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d

File Explorer

afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d

.dll 233KB

afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d

IMPHASH 483d40359f0235b62e35a1791e343595
SHA256 afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d
MD5 714f3a3828aad4941a944d21e72240a7
SHA1 09e0e6a9c8d7fc018378dd1d5129be180c34facc
SHA512 66eff5afcfe97955283f9106bddda6df9c93543491d99244ecd9ae0f56fab0e89a6355964824e3e82bf0a2eb17d11e01a74ada1c44e84567cac4a5f0cb4172bb
SSDEEP 6144:xFhw85cgrrdSV1U773PfeUVS8hbQzX4DT3OKNz:x3nVhSV1U33P2UVbBAWz
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\code\git\pluginstall\pdb\IEPlugin.pdb

kernel32

CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot InitializeCriticalSection DeleteCriticalSection WriteFile SetFilePointer ReadFile GetFileSize CreateFileW FindNextFileW FindFirstFileW DeleteFileW GetLastError ResumeThread CreateProcessW VirtualQuery VirtualProtect VirtualAlloc InterlockedCompareExchange GetCurrentThreadId FlushInstructionCache GetCurrentProcess GetThreadContext SetThreadContext SuspendThread GetCurrentThread SetLastError GetModuleHandleW RaiseException InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement LoadLibraryW GetModuleFileNameW EnterCriticalSection LeaveCriticalSection lstrlenW GetTickCount IsBadReadPtr lstrcmpiW MultiByteToWideChar LoadLibraryExW DeviceIoControl Sleep WritePrivateProfileStringW GetPrivateProfileIntW GetPrivateProfileStringW WaitForSingleObject MoveFileExW SetThreadPriority CreateThread SetThreadLocale GetThreadLocale ResetEvent CreateEventW GetModuleFileNameA OutputDebugStringA FormatMessageA lstrlenA WideCharToMultiByte GetTempPathW CompareStringW FlushFileBuffers WriteConsoleW GetProcAddress GetFileAttributesW FindResourceExW FindResourceW LoadResource LockResource FreeLibrary SizeofResource SetStdHandle GetConsoleMode GetConsoleCP SetEnvironmentVariableA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount GetTimeZoneInformation HeapCreate GetStdHandle GetStringTypeW ExitProcess LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo IsProcessorFeaturePresent TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCommandLineA GetSystemTimeAsFileTime DecodePointer EncodePointer RtlUnwind GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy

user32

wsprintfW CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegEnumKeyExW

shell32

CommandLineToArgvW SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc

oleaut32

LoadTypeLi VariantChangeType VariantClear SysFreeString VarUI4FromStr SysStringLen LoadRegTypeLi SysAllocString UnRegisterTypeLi RegisterTypeLi VariantInit

shlwapi

PathAppendW PathMatchSpecW PathRemoveFileSpecW PathFileExistsW StrStrIW

wininet

InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle HttpQueryInfoW InternetCreateUrlW InternetCrackUrlW

ws2_32

ntohs WSAStartup WSAGetLastError getpeername

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpConnect WinHttpCloseHandle WinHttpReadData WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest

imagehlp

CheckSumMappedFile

Sharing

General

Malware Config

Signatures

File Explorer

afe210036357ac467801e6cb276e835dcc43a1c5764f46e7e6a2c2a44d4e848d

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

ws2_32

winhttp

imagehlp

generic