8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954

Sharing

Copy URL Twitter E-mail

General

Target
8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954
Size 208KB
Sample241028-cgdbmaxfkb
SHA256 8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954
MD5 8e9957f18f5629215bcc0ec78d263c0e
SHA1 8b75f8826a62fee0fb09e6d18ebb2e0f4549c549
SHA512 06b56dfc1ea9a3f956f2c05491a5941eb130a767bb94664bad51c93b5442e9bea96bf4fb9f9fc1be682bfb40818adef64307f2be631d2b43b27e273fc7eabc0b
SSDEEP 6144:Fa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:FbapK0JCmRcU9vVokf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954

File Explorer

8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954

.exe 208KB

8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954

IMPHASH e391eee2fda3671a828f8ce7165ca399
SHA256 8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954
MD5 8e9957f18f5629215bcc0ec78d263c0e
SHA1 8b75f8826a62fee0fb09e6d18ebb2e0f4549c549
SHA512 06b56dfc1ea9a3f956f2c05491a5941eb130a767bb94664bad51c93b5442e9bea96bf4fb9f9fc1be682bfb40818adef64307f2be631d2b43b27e273fc7eabc0b
SSDEEP 6144:Fa1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:FbapK0JCmRcU9vVokf
MD5 SHA1 SHA512 SSDEEP

windows:2 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathA GetModuleHandleW ConnectNamedPipe GetModuleFileNameA EnumTimeFormatsW SuspendThread GetWindowsDirectoryW GetPriorityClass lstrlen CreateThread GetSystemDefaultLangID FlushFileBuffers ReadDirectoryChangesW GetDateFormatA BeginUpdateResourceW FreeResource GetSystemDirectoryA CreateMutexW GetModuleFileNameW GetModuleHandleA LoadLibraryW FatalAppExitA SetLocaleInfoW GetProcessHeap GetDiskFreeSpaceA GetProcAddress FindResourceA GetOEMCP lstrcpyW GetThreadPriority GlobalGetAtomNameW MoveFileW CompareStringA LocalFree MultiByteToWideChar GetVersionExW GetACP

user32

LoadMenuIndirectA UnregisterClassW GetClassInfoExW RegisterClassA GetClassNameA LoadMenuW DefDlgProcW SetWindowRgn GetParent DialogBoxIndirectParamA LoadMenuA GetClassInfoW DrawTextW CreateDialogIndirectParamW wvsprintfA LoadCursorW EnumWindows DialogBoxIndirectParamW CharNextW FindWindowW GetDCEx GetSysColor GetMenuStringW GetTopWindow LoadBitmapA TrackPopupMenuEx AppendMenuW InsertMenuItemA GetWindowRect MessageBoxW SetActiveWindow EnumDesktopsA CreatePopupMenu FindWindowA MessageBoxIndirectW CreateAcceleratorTableW CharLowerA DeleteMenu GetForegroundWindow EnumDesktopWindows EnumDesktopsW CopyRect OpenClipboard GetDlgItemTextW GetWindowLongW GetMenuItemCount CheckDlgButton CreateAcceleratorTableA WaitForInputIdle DialogBoxParamW PostQuitMessage GetActiveWindow CreateCaret RegisterWindowMessageW GetClassNameW GetMenuItemInfoA EndMenu WinHelpA SetCapture SetTimer CreateMenu CreateDialogParamA SendDlgItemMessageA LoadCursorA DefWindowProcW EnumDesktopsA SetMenu

gdi32

GetBrushOrgEx StrokeAndFillPath CreateFontW GetEnhMetaFilePixelFormat GetPixel GetViewportOrgEx CreateDCA CopyMetaFileW AbortPath RemoveFontResourceA GetKerningPairsA EnumFontFamiliesExW AddFontResourceW Rectangle GetDeviceGammaRamp PolyPolygon RectInRegion GetGlyphIndicesA CreatePolygonRgn SetColorSpace SetMetaFileBitsEx CreateBitmap OffsetRgn EndDoc CreateDIBPatternBrush PlayEnhMetaFile RestoreDC GetCharWidth32W PaintRgn StartFormPage

advapi32

RegDeleteKeyW RegOpenKeyA RegQueryMultipleValuesW RegEnumValueW RegSetValueA RegEnumKeyExA RegCreateKeyExA RegRestoreKeyW RegCloseKey RegEnumKeyA RegEnumKeyW RegDeleteValueA RegQueryValueW RegReplaceKeyW RegFlushKey CryptSetProviderA RegOpenKeyW RegEnumValueA

shell32

ExtractIconExA

comctl32

ImageList_SetImageCount ImageList_Duplicate FlatSB_EnableScrollBar DllGetVersion ImageList_SetBkColor InitCommonControls ImageList_GetBkColor

comdlg32

FindTextA LoadAlterBitmap ReplaceTextW GetFileTitleW GetSaveFileNameW ReplaceTextA

oleaut32

VarR8FromDisp VarUI1FromStr VarDateFromUI8 OleLoadPictureFile VarUI1FromDisp VarUI8FromCy

wininet

GopherGetLocatorTypeA ShowCertificate HttpQueryInfoA SetUrlCacheHeaderData FindFirstUrlCacheContainerA GetUrlCacheEntryInfoA FindNextUrlCacheContainerA DeleteUrlCacheEntry InternetGetConnectedState GetUrlCacheConfigInfoW InternetConfirmZoneCrossing InternetGetConnectedStateEx InternetCreateUrlA CreateUrlCacheEntryA InternetSetPerSiteCookieDecisionW InternetSetOptionW RetrieveUrlCacheEntryFileW FindCloseUrlCache UrlZonesDetach

urlmon

IsValidURL CoInternetCreateSecurityManager URLDownloadToCacheFileW Extract MkParseDisplayNameEx GetMarkOfTheWeb CopyStgMedium HlinkNavigateMoniker

wsock32

GetAddressByNameA GetAddressByNameW s_perror WSAAsyncGetProtoByNumber socket WSAAsyncGetHostByName send AcceptEx shutdown

crypt32

CertFreeCRLContext CertGetIntendedKeyUsage CertGetNameStringW PFXExportCertStoreEx CryptVerifyMessageHash CertGetIssuerCertificateFromStore I_CryptEnableLruOfEntries I_CryptGetAsn1Decoder CertEnumSystemStoreLocation I_CryptSetTls

Name

.ehkoKk

Size

2KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WbOYt

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jVQpnF

Size

1KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MAgzG

Size

109KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8f9ff92b2219b09bb54ad8e234d230decc58133bd607665a0d6f2a8a264ba954

kernel32

user32

gdi32

advapi32

shell32

comctl32

comdlg32

oleaut32

wininet

urlmon

wsock32

crypt32

generic