e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f

Sharing

Copy URL Twitter E-mail

General

Target
e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f
Size 580KB
Sample240621-e4y8qasckr
SHA256 e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f
MD5 5178da716e24bdfc32b88bef7a2c8190
SHA1 0cc8df1359f172c5597d1a8fb8b22e4196e5c827
SHA512 aa4b2ab0b6bcc65caf37679045774bc09efecfccb9a9f4f59297ade15ce0e4c322185bc88f3d62b1734542fb8d3cbc66625a89fdd72a5f87d1482e3d458f3d66
SSDEEP 12288:uYaM4+9+4nl15qhRKRlibgQKPGUdC6B3hBKYqS:Z9+4lDxikQOlICUYqS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f

File Explorer

e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f

.dll 580KB

e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f

IMPHASH 0ab4133e063bb192b89d9c96a8508c8b
SHA256 e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f
MD5 5178da716e24bdfc32b88bef7a2c8190
SHA1 0cc8df1359f172c5597d1a8fb8b22e4196e5c827
SHA512 aa4b2ab0b6bcc65caf37679045774bc09efecfccb9a9f4f59297ade15ce0e4c322185bc88f3d62b1734542fb8d3cbc66625a89fdd72a5f87d1482e3d458f3d66
SSDEEP 12288:uYaM4+9+4nl15qhRKRlibgQKPGUdC6B3hBKYqS:Z9+4lDxikQOlICUYqS
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

344421

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

PlaySoundA

shlwapi

PathFileExistsA

wininet

InternetReadFile HttpQueryInfoA InternetConnectA InternetSetOptionA InternetQueryOptionA HttpSendRequestA HttpOpenRequestA InternetCloseHandle InternetOpenA InternetCrackUrlA DeleteUrlCacheEntry FindCloseUrlCache FindNextUrlCacheEntryA FindFirstUrlCacheEntryA

setupapi

SetupIterateCabinetA

kernel32

WideCharToMultiByte RemoveDirectoryA DeleteFileA CloseHandle WriteFile CreateFileA GetTempPathA MoveFileExA Sleep InterlockedIncrement InterlockedDecrement GetModuleFileNameA GetLastError GetStringTypeA GetOEMCP GetVersionExA MultiByteToWideChar lstrlenA FreeLibrary FindClose FindNextFileA GetProcAddress FindFirstFileA lstrcpyA lstrcatA SetLastError LoadLibraryA OutputDebugStringA LoadLibraryW GetModuleFileNameW GetModuleHandleA SetEvent lstrlenW GetStringTypeW DebugBreak GlobalUnlock GlobalLock GetVolumeInformationA GetDriveTypeA GetLogicalDriveStringsA CopyFileA MoveFileA GetTempFileNameA WaitForSingleObject ResetEvent CreateEventA LeaveCriticalSection EnterCriticalSection GlobalAlloc FlushInstructionCache GetCurrentProcess GetCurrentProcessId lstrcmpA InitializeCriticalSection DeleteCriticalSection GetCurrentThread HeapFree HeapAlloc GetProcessHeap SetCurrentDirectoryA DisableThreadLibraryCalls GetShortPathNameA SizeofResource LoadResource FindResourceA LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte HeapDestroy SetEndOfFile CompareStringA CompareStringW GetCurrentThreadId GetVersion GetModuleHandleW TerminateThread VirtualFree HeapCreate VirtualAlloc SetUnhandledExceptionFilter GetEnvironmentVariableA TlsFree TlsAlloc TlsGetValue TerminateProcess ExitProcess HeapSize HeapReAlloc GetCurrentDirectoryA GetCommandLineA CreateDirectoryA GetFullPathNameA SetEnvironmentVariableA GetSystemTime GetTimeZoneInformation GetLocalTime TlsSetValue CreateThread ExitThread RtlUnwind RaiseException ResumeThread InterlockedExchange LocalFree LocalAlloc GetACP GetCPInfo FlushFileBuffers SetStdHandle IsBadCodePtr IsBadWritePtr GetEnvironmentStringsW GetEnvironmentStrings IsBadReadPtr FreeEnvironmentStringsA SetFilePointer FreeEnvironmentStringsW GetFileType GetStdHandle GetStartupInfoA ReadFile LCMapStringW SetHandleCount UnhandledExceptionFilter LCMapStringA

user32

PostMessageA UnhookWindowsHookEx CharLowerA GetClientRect CallNextHookEx GetSubMenu GetParent MessageBoxA EmptyClipboard LoadCursorFromFileA SetWindowTextA GetSystemMetrics UnregisterClassA IsWindow SendMessageA wsprintfA GetDlgItem TranslateMessage DispatchMessageA SetActiveWindow MoveWindow GetActiveWindow CreateWindowExA DestroyCursor InvalidateRgn SetCapture ReleaseCapture DestroyAcceleratorTable CreateAcceleratorTableA GetDesktopWindow RedrawWindow BeginPaint EndPaint IsChild SetFocus CallWindowProcA CheckMenuItem AppendMenuA CreatePopupMenu DestroyWindow DrawEdge OpenClipboard GetClipboardData CloseClipboard GetWindowTextLengthA GetWindowTextA DefWindowProcA GetClassInfoExA RegisterClassExA RegisterWindowMessageA LoadCursorA EndMenu SetWindowRgn GetDC OffsetRect GetMenuItemInfoA CopyRect IsWindowVisible GetWindow ShowWindow CharUpperA GetAsyncKeyState GetWindowRect DestroyMenu LoadMenuA InsertMenuA LoadStringA LoadImageA MapWindowPoints GetFocus GetMessagePos GetCursorPos SetWindowLongA wvsprintfA GetWindowLongA SetCursor SetWindowPos WindowFromPoint GetKeyState ScreenToClient PtInRect KillTimer GetClassNameA InvalidateRect SetTimer SetWindowsHookExA TrackPopupMenu GetSysColor CharNextA FillRect ReleaseDC EnableMenuItem

gdi32

GetTextExtentPoint32A ExtTextOutA GetTextExtentPointA GetStockObject CreateCompatibleBitmap SelectObject CreateBrushIndirect GetTextMetricsA SetBkColor SetBkMode SetTextColor CreateFontA CreateRectRgn GetObjectA GetDeviceCaps CreateSolidBrush DeleteObject DeleteDC CreateCompatibleDC BitBlt

shell32

SHAddToRecentDocs ShellExecuteA DragQueryFileA

ole32

CoTaskMemRealloc OleInitialize CoInitialize ReleaseStgMedium CoUninitialize RegisterDragDrop CreateStreamOnHGlobal OleRun OleUninitialize CLSIDFromProgID CLSIDFromString CoTaskMemFree StringFromCLSID CoTaskMemAlloc OleLockRunning CoCreateInstance CoCreateGuid

oleaut32

SysStringByteLen SysAllocStringLen RegisterTypeLi SysAllocString SysFreeString VariantClear VariantInit VariantCopy VariantChangeType LoadTypeLi SafeArrayCreate SafeArrayDestroy SafeArrayPutElement SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData DispCallFunc LoadRegTypeLi OleCreateFontIndirect VarUI4FromStr SysAllocStringByteLen SysStringLen GetErrorInfo

rpcrt4

UuidFromStringA

Name

.text

Size

404KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARED

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e06a641e6b22f71b6d2f414582e0150c2a5afd2c382f5cb3e62c3ebf0ba50c0f

winmm

shlwapi

wininet

setupapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

rpcrt4

generic