ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf.exe
Size 268KB
Sample240827-v8j8cssdrh
SHA256 ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf
MD5 073d69b074ae7324ff0b8e49f3d1e5a6
SHA1 f032a64fea6e799b7654ed04a97ab59ef1ef09bd
SHA512 3ae5e711490bd56ab988f2a9c5832d2c4b4f5bc66d75384a268b1323fb898356d04b13e5a95228194bdc16b833e6e56c2abf554cfc72d703700d0caf90029a70
SSDEEP 6144:zjgwH2tOwzHk+729OhFYMpvxYMO3OKuRBC10MoBu73m:owIOwzHZDheuv+Nx/1OZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf.exe
unpack001/mqfvdjq.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf.exe

.exe 268KB
j3trile8cqz

211KB
mqfvdjq.exe

.exe 70KB
pmwvpod

4KB

ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf.exe

IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
SHA256 ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf
MD5 073d69b074ae7324ff0b8e49f3d1e5a6
SHA1 f032a64fea6e799b7654ed04a97ab59ef1ef09bd
SHA512 3ae5e711490bd56ab988f2a9c5832d2c4b4f5bc66d75384a268b1323fb898356d04b13e5a95228194bdc16b833e6e56c2abf554cfc72d703700d0caf90029a70
SSDEEP 6144:zjgwH2tOwzHk+729OhFYMpvxYMO3OKuRBC10MoBu73m:owIOwzHZDheuv+Nx/1OZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12731

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA Sleep GetTickCount GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GetWindowsDirectoryA SetCurrentDirectoryA GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA CreateThread GlobalLock lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

mqfvdjq.exe

IMPHASH 613c94c4cce26a627c589026fc701947
SHA256 622e49fda8e46b80ebfef2b6d2180a9a425d07525b962e1e4471088431b183c2
MD5 1375d6ebdb70a3099887a5e1ea4c9769
SHA1 1a2ed11d9428c34de0d60fdb2bb7c735e99d9382
SHA512 08b030d32251cd4879732cae94c86038d6970519c6efbc7356ddeebc000002a704170517e8a567f37b54238bc498756dc459da6323fe33ae7486a55de63f57e8
SSDEEP 1536:TSfyG8qhxb+q8AyMAtc8jpsWjcdRq6tl7:ayGt+qGhjWYKl
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\pxati\xgbtym\epyg\94463c810156487d8eca3a4d4d69bb5e\whdkes\tteossrq\Release\tteossrq.pdb

shlwapi

StrRChrW StrStrIA

kernel32

GetFileSize ReadFile VirtualAlloc GetConsoleWindow CreateFileW GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointerEx WriteConsoleW SetStdHandle ExitProcess LCMapStringW HeapSize GetStringTypeW HeapReAlloc HeapAlloc OutputDebugStringW RtlUnwind LoadLibraryExW IsProcessorFeaturePresent IsDebuggerPresent GetCPInfo GetOEMCP GetACP IsValidCodePage HeapFree LeaveCriticalSection EnterCriticalSection GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess Sleep InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetLastError SetLastError GetCurrentThreadId EncodePointer DecodePointer CloseHandle GetModuleHandleExW GetProcAddress MultiByteToWideChar WideCharToMultiByte GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime

msvfw32

DrawDibChangePalette ICImageDecompress DrawDibProfileDisplay ord2 ICSeqCompressFrameStart

avifil32

EditStreamCut AVIStreamReadData AVISaveVA

ws2_32

WSCInstallNameSpace htonl WSAEnumProtocolsA WSAAddressToStringW WSAEnumNetworkEvents

oleaut32

VarDecInt GetRecordInfoFromGuids SafeArrayCreate VarBstrFromUI2

rtm

MgmGetNextMfe RtmCloseEnumerationHandle MgmDeInitialize RtmDeleteRoute

user32

GetTabbedTextExtentW LoadBitmapA TranslateMessage ShowWindow CreateIconFromResourceEx IMPQueryIMEW CharUpperA RegisterClassA LoadStringW

shell32

SHGetFileInfoW SHEmptyRecycleBinA CommandLineToArgvW FindExecutableA ExtractIconA

winspool.drv

GetPrinterDataExW SetJobA SetFormA AdvancedDocumentPropertiesW SeekPrinter SplDriverUnloadComplete ReadPrinter

ccac04114dca63da18b7f5bbb4b243630c0c0336a1c222dd9b46087dae66dfdf.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

j3trile8cqz

mqfvdjq.exe

shlwapi

kernel32

msvfw32

avifil32

ws2_32

oleaut32

rtm

user32

shell32

winspool.drv

generic

pmwvpod