b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13

Sharing

Copy URL Twitter E-mail

General

Target
b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13
Size 1.6MB
Sample241018-gvtb8athpl
SHA256 b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13
MD5 263c57d5c64e5932e024b98b1a4ae5f1
SHA1 5085b990b299666dd6e2565ee16e320da64c5e74
SHA512 bb0d901a0be8416e639c72e250fd12fe50b1444403c582b5026c5def6f0c8cc5fb142f7606d3475f3f056c19f2c832da809a9c03ac166ee3f835d9df7afa96d1
SSDEEP 24576:BP6+D3feaaibg5UpjbRkYEDLT+Ls2QPP3CAhCd:BPh3zaiDJb5EPT+4PP3Ci
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13

File Explorer

b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13

.exe 1.6MB

b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13

IMPHASH d54bce4e36f8c3be3f5b986b8fa2e2fa
SHA256 b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13
MD5 263c57d5c64e5932e024b98b1a4ae5f1
SHA1 5085b990b299666dd6e2565ee16e320da64c5e74
SHA512 bb0d901a0be8416e639c72e250fd12fe50b1444403c582b5026c5def6f0c8cc5fb142f7606d3475f3f056c19f2c832da809a9c03ac166ee3f835d9df7afa96d1
SSDEEP 24576:BP6+D3feaaibg5UpjbRkYEDLT+Ls2QPP3CAhCd:BPh3zaiDJb5EPT+4PP3Ci
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

166568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar GlobalFlags GetSystemInfo GetCurrentProcessId CreateProcessW WideCharToMultiByte VirtualQuery CreateEventW SetEvent ResetEvent GetSystemTimeAsFileTime lstrcmpiW LoadLibraryExW WriteConsoleW FlushFileBuffers GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW GetConsoleMode GetConsoleCP GetFileType SetFilePointerEx GetStdHandle GetCommandLineA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW GetFileAttributesW FindClose TerminateProcess GetCurrentProcess FindNextFileW GetCommandLineW SetLastError FreeLibrary GetProcAddress LoadLibraryW GetTickCount FindResourceW LoadResource LockResource FreeResource SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc CreateThread GetLocalTime WriteFile LeaveCriticalSection GetCurrentThreadId GetModuleHandleW IsDebuggerPresent GetModuleFileNameW Sleep ExitProcess CloseHandle CreateFileW TryEnterCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount HeapFree

user32

SetWindowLongPtrW RegisterClassExW PostQuitMessage GetClassInfoExW CharNextW DeleteMenu GetWindowTextW DestroyAcceleratorTable DestroyMenu GetClassNameW EndPaint GetNextDlgTabItem BeginPaint IsIconic GetDlgItem SetFocus UnregisterClassW MessageBoxW DestroyWindow IsWindow DefWindowProcW DispatchMessageW TranslateMessage GetMessageW PeekMessageW GetWindowLongW SendMessageW IntersectRect IsRectEmpty WinHelpW SetMenu IsWindowEnabled GetSysColor IsChild GetDlgCtrlID IsDialogMessageW DrawIcon FillRect SetWindowRgn IsWindowVisible GetFocus CallWindowProcW GetSystemMenu GetLastActivePopup GetWindowTextLengthW IsZoomed GetTopWindow ClientToScreen DestroyIcon SetRect RedrawWindow ScreenToClient TranslateAcceleratorW GetWindowThreadProcessId MonitorFromWindow SetActiveWindow WaitForInputIdle SetWindowTextW InvalidateRect SetWindowPos SetWindowLongW GetKeyState SetCursor GetWindow ShowWindow EnableWindow AdjustWindowRectEx ReleaseDC GetClientRect GetSystemMetrics GetDC GetWindowRect LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW GetActiveWindow LoadStringW GetWindowLongPtrW GetMonitorInfoW EnumWindows PostMessageW CreateWindowExW

gdi32

CreateEllipticRgn CreateSolidBrush CreateRoundRectRgn GetClipBox CreateFontIndirectW SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GdiAlphaBlend GetStockObject GetDeviceCaps DeleteDC DeleteObject GetObjectW SetStretchBltMode

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegCloseKey

shell32

DragFinish DragQueryFileW Shell_NotifyIconW

ole32

CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VarUI4FromStr

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControlsEx

gdiplus

GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGetImagePixelFormat GdipFree GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImageWidth GdipCreateBitmapFromFile

ws2_32

WSACleanup

Name

.text

Size

241KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b18eb8aaac0a876842de4b351262fc453975e75ebf7f2e96918bf00ceead8d13

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

ws2_32

generic