2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533N

Sharing

Copy URL Twitter E-mail

General

Target
2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533N
Size 353KB
Sample241013-lf1j7szalg
SHA256 2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533
MD5 e9924e260ec9111764aee7799ce0fa30
SHA1 dacd296116b2f7b16e06d11c2a54f5fc9b3da161
SHA512 eee4ee9a4a531a9273eb9809902bb0069a2f377ba0ed2de4d2ee1ae6d1dfd47d5070f1ba57336a6aaa6fba20722a286f1defb114d1ba17529808acc4c5493ffa
SSDEEP 6144:boT/xZkeIrr+xnu5t2QaGWtxtFm0V+aaw9ZKWtXqyr5:kT/xZkeIsnqt2RnS0V+S9Z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533N

File Explorer

2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533N

.exe 353KB

2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533N

IMPHASH 2b5598c46bacc1d6fab5f0115134da9e
SHA256 2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533
MD5 e9924e260ec9111764aee7799ce0fa30
SHA1 dacd296116b2f7b16e06d11c2a54f5fc9b3da161
SHA512 eee4ee9a4a531a9273eb9809902bb0069a2f377ba0ed2de4d2ee1ae6d1dfd47d5070f1ba57336a6aaa6fba20722a286f1defb114d1ba17529808acc4c5493ffa
SSDEEP 6144:boT/xZkeIrr+xnu5t2QaGWtxtFm0V+aaw9ZKWtXqyr5:kT/xZkeIsnqt2RnS0V+S9Z
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wisptis.pdb

msvcrt

_CxxThrowException swscanf _CIfmod _ftol2_sse _CIsqrt _CIatan2 _ftol2 _wcsicmp _CIpow fclose fputws _wfopen _beginthreadex _isnan wcsstr wcschr malloc _wcsnicmp _wcstoi64 _itow __wgetmainargs _cexit _exit _XcptFilter exit _wcmdln _initterm _amsg_exit __setusermatherr __p__commode __p__fmode __set_app_type ?terminate@@YAXXZ _except_handler4_common _unlock __dllonexit _lock _vsnwprintf memcpy _purecall free wcsrchr __CxxFrameHandler3 ??2@YAPAXI@Z realloc memmove memset _wtol _wcsdup ??_U@YAPAXI@Z ??_V@YAXPAX@Z _controlfp ??1type_info@@UAE@XZ _onexit ??3@YAXPAX@Z

ntdll

EtwTraceMessage EtwEventWrite WinSqmSetDWORD WinSqmIsOptedIn EtwLogTraceEvent WinSqmIncrementDWORD WinSqmAddToStream WinSqmAddToStreamEx WinSqmAddToAverageDWORD NtQuerySystemInformation EtwGetTraceEnableFlags EtwGetTraceEnableLevel EtwGetTraceLoggerHandle EtwRegisterTraceGuidsW EtwEventUnregister EtwEventRegister EtwUnregisterTraceGuids

user32

SetWinEventHook GetMessageW UnhookWinEvent CharPrevW OpenDesktopW SetThreadDesktop OpenInputDesktop CallWindowProcW ord2002 DefWindowProcW ord2500 GetForegroundWindow GetGUIThreadInfo GetWindowRect IsChild ChildWindowFromPointEx ScreenToClient PtInRect GetUserObjectInformationW CloseDesktop CharNextW MonitorFromWindow GetCursorPos ChangeWindowMessageFilterEx SetWindowsHookExW CallNextHookEx EnumDisplayMonitors GetMonitorInfoW EnumDisplayDevicesW MsgWaitForMultipleObjectsEx PeekMessageW TranslateMessage DispatchMessageW MsgWaitForMultipleObjects SetWindowLongW GetGestureConfig GetPropW GetClassInfoExW LoadCursorW wsprintfW SetRect RegisterClassExW DestroyWindow SendMessageTimeoutW UnhookWindowsHookEx RegisterDeviceNotificationW PostThreadMessageW UnregisterDeviceNotification CreateWindowExW ReleaseDC GetDesktopWindow GetDC SystemParametersInfoW WindowFromPhysicalPoint EnumDisplaySettingsExW GetSystemMetrics LoadStringW GetRawInputDeviceList GetRawInputDeviceInfoW IsTouchWindow SetRectEmpty SetPhysicalCursorPos SendInput LogicalToPhysicalPoint GetDoubleClickTime SetDoubleClickTime PostMessageW IsWindow GetWindowLongW GetAncestor EqualRect GetClientRect MapWindowPoints GetClassNameW GetWindowThreadProcessId CharLowerW InflateRect

ole32

CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitializeEx CoTaskMemFree StringFromGUID2 CoCreateGuid CoRevokeClassObject CoRegisterClassObject CoTaskMemRealloc CoInitializeSecurity

oleaut32

VariantClear RegisterTypeLi LoadTypeLi SysAllocString SysStringLen SysFreeString VarUI4FromStr

hid

HidP_GetLinkCollectionNodes HidD_GetFeature HidP_GetCaps HidD_GetAttributes HidD_GetPreparsedData HidP_MaxUsageListLength HidP_GetValueCaps HidP_GetButtonCaps HidP_GetUsages HidD_GetHidGuid HidP_GetSpecificValueCaps HidD_GetProductString HidP_GetUsageValue HidD_FlushQueue HidD_FreePreparsedData

setupapi

SetupDiOpenDeviceInterfaceW SetupDiGetDeviceInstanceIdW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsExW SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW

wtsapi32

WTSRegisterSessionNotification

advapi32

RegOpenKeyExA MakeAbsoluteSD RegOpenKeyExW RegQueryValueExW RegEnumKeyExW RegEnumValueW RegSetValueExW RegCreateKeyExW RegEnumKeyW RegGetValueW RegOpenKeyW WmiDevInstToInstanceNameW WmiQuerySingleInstanceW WmiCloseBlock WmiOpenBlock IsWellKnownSid GetTokenInformation OpenProcessToken RegDeleteValueW RegQueryInfoKeyW RegSetValueW RegDeleteKeyExW RegCloseKey

slc

SLGetWindowsInformationDWORD

gdi32

GetDeviceCaps

kernel32

LocalAlloc UnhandledExceptionFilter FlushInstructionCache OpenEventW CloseHandle GetTickCount64 TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleA SetUnhandledExceptionFilter Sleep VirtualFree LoadLibraryA HeapAlloc CreateWaitableTimerW QueryPerformanceFrequency GetCurrentThread SetThreadPriority GetOverlappedResult GetCurrentThreadId CancelIo WaitForMultipleObjects ReadFile DeviceIoControl CancelWaitableTimer SetWaitableTimer InterlockedDecrement InterlockedIncrement CreateFileMappingW MapViewOfFile CreateEventW CreateMutexW LocalFree ResetEvent SetEvent UnmapViewOfFile QueryPerformanceCounter GetCurrentProcess DuplicateHandle QueueUserAPC OpenProcess GetTickCount CreateFileW WaitForSingleObject DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError RaiseException InitializeCriticalSection InterlockedCompareExchange SignalObjectAndWait FreeLibrary GetProcAddress GlobalAddAtomW WaitForMultipleObjectsEx SetLastError GlobalDeleteAtom InitializeCriticalSectionAndSpinCount GetVersionExW VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery MultiByteToWideChar lstrlenW lstrcpyW LoadLibraryW GetModuleHandleW lstrcmpiW lstrcpynW GetModuleFileNameW GetWindowsDirectoryW lstrcatW OpenMutexW SetProcessShutdownParameters SetPriorityClass lstrlenA SizeofResource LoadResource FindResourceW LoadLibraryExW HeapSetInformation SetThreadExecutionState MulDiv GetStartupInfoW CompareStringW GetCommandLineW ReleaseMutex WerSetFlags HeapFree GetProcessHeap InterlockedExchange

magnification

MagInitialize MagUninitialize

imm32

ImmDisableIME

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

oleacc

AccessibleObjectFromEvent

Sharing

General

Malware Config

Signatures

File Explorer

2e94e32e2aa0cc21e931505e936b420950eaad185e6ce3a4508c0e00b6a23533N

msvcrt

ntdll

user32

ole32

oleaut32

hid

setupapi

wtsapi32

advapi32

slc

gdi32

kernel32

magnification

imm32

api-ms-win-security-sddl-l1-1-0

oleacc

generic