b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65

Sharing

Copy URL Twitter E-mail

General

Target
b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65
Size 303KB
Sample241005-pmbq7sshml
SHA256 b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65
MD5 32a789f533962a3b74537fe4648944ef
SHA1 5bd15035cb0c90346112c1ceaa51ae3c1f7cb7af
SHA512 b67347465d70050a3b8c69e7019ff470ada290f9c80419f0e05006bee985dc8d4fd2dcf0f5f58ed66ace32f6fe71f9ba486e9a7abe02c87d70cff344d4c54937
SSDEEP 6144:pXFKo5lGhoBRQXvUv2K34mJgBNJGuOwIu/taVBrEFCfp9rJXoV6UzOLz3VcX+:pXRGhSv2OIP+w3/4VyopIc3LCX+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65
unpack001/yplqoz.exe

File Explorer

b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65

.exe 303KB
baiotmx.bpc

205KB
yplqoz.exe

.exe 167KB

b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65
MD5 32a789f533962a3b74537fe4648944ef
SHA1 5bd15035cb0c90346112c1ceaa51ae3c1f7cb7af
SHA512 b67347465d70050a3b8c69e7019ff470ada290f9c80419f0e05006bee985dc8d4fd2dcf0f5f58ed66ace32f6fe71f9ba486e9a7abe02c87d70cff344d4c54937
SSDEEP 6144:pXFKo5lGhoBRQXvUv2K34mJgBNJGuOwIu/taVBrEFCfp9rJXoV6UzOLz3VcX+:pXRGhSv2OIP+w3/4VyopIc3LCX+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

yplqoz.exe

IMPHASH d8572827b61e4fc281b44a7c799ecf4d
SHA256 8acf4c88e097cfcba3bfa08c24884c446bb943f5a3b5eb610f50db67574de771
MD5 c7e6dba02c269734255208e86e23fce8
SHA1 746596f46256c1752b7d101d0dc54d0baa64e29c
SHA512 b7c9a608fc3a82fcd7cfa3c6c8f7be3af9d028ffcef1e680f20364796ef8c4351759be036320ed203f785a04b0acd11d0d49217b557b36b5b50264e2b9448abf
SSDEEP 3072:wnqSbagMaHxt6YHJIKAi+jNcnfk9rJX/U8Gn:wnq2EYWbi+y
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

imm32

ImmSetOpenStatus ImmSetCompositionStringA ImmGetIMEFileNameA ImmDestroyContext ImmGenerateMessage ImmSetConversionStatus ImmSetCompositionFontW

kernel32

GetConsoleMode GetConsoleCP FlushFileBuffers CloseHandle HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetFileType IsDebuggerPresent GetProcessHeap ReadFile GetOEMCP GetACP IsValidCodePage HeapSize GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetFilePointerEx IsProcessorFeaturePresent OutputDebugStringW LoadLibraryExW LoadLibraryW SetStdHandle WriteConsoleW ReadConsoleW CreateFileW EnumTimeFormatsW GetProcAddress GetModuleHandleA GetCurrentThreadId InterlockedIncrement InterlockedDecrement WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection Sleep EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetLastError HeapFree RaiseException RtlUnwind GetCommandLineW InitializeCriticalSectionAndSpinCount GetCPInfo HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW

wininet

HttpAddRequestHeadersA DeleteUrlCacheContainerA FindNextUrlCacheContainerA InternetWriteFileExW FindNextUrlCacheEntryW RetrieveUrlCacheEntryFileW InternetGetCertByURL

rtutils

RouterLogRegisterA TraceRegisterExA RouterLogEventDataW TracePrintfA TracePutsExA

msi

ord137 ord134 ord148 ord27 ord44 ord152

ws2_32

WSADuplicateSocketA WSAAccept WSAGetOverlappedResult getprotobyname WSALookupServiceEnd WSAWaitForMultipleEvents

msacm32

acmFilterDetailsW acmFilterTagEnumW acmFormatDetailsW acmFilterChooseA acmFilterDetailsA acmFilterTagDetailsW

mscms

TranslateBitmapBits GenerateCopyFilePaths GetStandardColorSpaceProfileW InstallColorProfileA GetColorDirectoryA SetColorProfileHeader DisassociateColorProfileFromDeviceA DisassociateColorProfileFromDeviceW

avifil32

EditStreamPaste AVISaveV AVIFileInfoA AVIFileExit

msvfw32

MCIWndRegisterClass ICCompressorFree

avicap32

capGetDriverDescriptionW

comdlg32

PageSetupDlgW ReplaceTextW PrintDlgExW ChooseColorW ChooseColorA ChooseFontW GetOpenFileNameA GetFileTitleW

b88b53db5c1fd0779cb7718630d7ac90f0ff81cfc7e8495bff1325743adeff65

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

baiotmx.bpc

yplqoz.exe

imm32

kernel32

wininet

rtutils

msi

ws2_32

msacm32

mscms

avifil32

msvfw32

avicap32

comdlg32

generic