7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2aN

Sharing

Copy URL Twitter E-mail

General

Target
7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2aN
Size 152KB
Sample241109-mch2essfjp
SHA256 7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2a
MD5 8d4330965006c1ea68010959eccd96a0
SHA1 d7fd70850a4ada79f1ad630230dccb03461d5f86
SHA512 04d7a82acd328b252507fff7bbe75729ab14ef702110918eefbb297f0c2032dbff7e5a6410f8a9f4d6b53c825b1aea492f7bd6888e52ae12bb26b9f124963342
SSDEEP 3072:ByLRmnX+Okrspw8oSgUZavaz0twh44hb3jRHFlSYt+Fd7:8LgX2ccoic40b3jRllSDf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2aN

File Explorer

7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2aN

.dll 152KB

7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2aN

IMPHASH d4e8696e6b20406b189b6dcd9f6f819f
SHA256 7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2a
MD5 8d4330965006c1ea68010959eccd96a0
SHA1 d7fd70850a4ada79f1ad630230dccb03461d5f86
SHA512 04d7a82acd328b252507fff7bbe75729ab14ef702110918eefbb297f0c2032dbff7e5a6410f8a9f4d6b53c825b1aea492f7bd6888e52ae12bb26b9f124963342
SSDEEP 3072:ByLRmnX+Okrspw8oSgUZavaz0twh44hb3jRHFlSYt+Fd7:8LgX2ccoic40b3jRllSDf
MD5 SHA1 SHA512 SSDEEP

windows:0 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

234349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord825 ord389 ord6059 ord3229 ord5204 ord5808 ord1988 ord500 ord772 ord540 ord800 ord5356 ord690 ord823

msvcrt

strchr strncpy sscanf _EH_prolog __CxxFrameHandler wcscat memcpy malloc free strcpy srand memcmp strrchr strcat time localtime strftime vsprintf sprintf strlen memset rand atoi strcspn strstr _except_handler3 _CxxThrowException tolower toupper strcmp _strcmpi wcslen _mbsicmp __dllonexit _onexit ??1type_info@@UAE@XZ _initterm _adjust_fdiv

kernel32

UnmapViewOfFile CreateFileMappingA MapViewOfFile GetFileInformationByHandle FileTimeToSystemTime SystemTimeToFileTime FormatMessageA CreateProcessA GetLocalTime lstrcatA DeviceIoControl LocalFree InterlockedIncrement InterlockedExchange CreateMutexA ReleaseMutex SetLastError WinExec GetSystemDirectoryA lstrcpyA LoadLibraryA GetProcAddress CloseHandle WriteFile SetFilePointer CreateFileA GetModuleFileNameA GetCurrentProcess WideCharToMultiByte WaitForSingleObject CreateThread GetCurrentProcessId TerminateProcess OpenProcess GetTickCount MoveFileExA DeleteFileA Sleep lstrlenA FreeLibrary FindClose FindNextFileA FindFirstFileA ReadFile GetFileSize InterlockedDecrement GetSystemInfo WriteProcessMemory CreateDirectoryA ReadProcessMemory VirtualQueryEx GlobalFree GlobalAlloc GetVersionExA GetSystemDefaultUILanguage GlobalMemoryStatusEx MultiByteToWideChar GetLastError GetModuleFileNameW GetModuleHandleA LoadLibraryA LocalAlloc LocalFree GetModuleFileNameA ExitProcess

user32

wsprintfA GetDesktopWindow

advapi32

QueryServiceStatus LookupPrivilegeValueA RegQueryInfoKeyA RegEnumValueA CreateServiceA RegCreateKeyA OpenSCManagerA OpenServiceA CloseServiceHandle ChangeServiceConfigA StartServiceA AdjustTokenPrivileges RegOpenKeyA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegCloseKey RegOpenKeyExA OpenProcessToken

ws2_32

WSACleanup htons closesocket htonl sendto send __WSAFDIsSet recv connect setsockopt WSAIoctl WSAStartup socket ntohs inet_addr bind ioctlsocket select recvfrom WSAGetLastError

shlwapi

PathIsDirectoryA PathFileExistsA StrStrIA

ole32

CoInitializeSecurity CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetVartype SafeArrayAccessData SafeArrayUnaccessData VariantChangeType SysStringLen SafeArrayCreate SafeArrayDestroy SysFreeString SysAllocString VariantClear SysAllocStringByteLen VariantInit

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

netapi32

Netbios

Name

.text

Size

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fsesdf0

Size

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fsesdf1

Size

120KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7c2d9e6e0ef4c1a1da1cc6c9402c8643518935756783d83bbfa70b71fe2e8d2aN

mfc42

msvcrt

kernel32

user32

advapi32

ws2_32

shlwapi

ole32

oleaut32

msvcp60

netapi32

generic