cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581N

Sharing

Copy URL Twitter E-mail

General

Target
cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581N
Size 173KB
Sample241109-mxcp5stakd
SHA256 cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581
MD5 70b3724a4507ca70cc87820f1a54bd10
SHA1 016a20bc2a04b6922388b2ad2282b611a6c5eace
SHA512 344fe594cbadf9a8812b5e7c27a0e2d5d25728b1f16df009a84ac9ff4044f84e6ebeeff2b867a5c9876ac2532fbed994efb48cdb1c73b37ae7c8f39858fa9236
SSDEEP 3072:c5BuYAVrgUCPnN45zOZwAs9ThFEYSnjR1n0a3M1PQNIXyBWy23RPms6CJ1:c50gUClEO0PFdu1nrOyBX231mU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISArray.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/newadvsplash.dll
unpack001/$PLUGINSDIR/version.dll
unpack002/out.upx

File Explorer

cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581N

.exe 173KB
$PLUGINSDIR/NSISArray.dll

.dll 20KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/inetc.dll

.dll 27KB
$PLUGINSDIR/newadvsplash.dll

.dll 8KB
$PLUGINSDIR/splash.gif

.gif 64KB
$PLUGINSDIR/version.dll

.dll 6KB
out.upx

.dll 9KB

cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581N

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581
MD5 70b3724a4507ca70cc87820f1a54bd10
SHA1 016a20bc2a04b6922388b2ad2282b611a6c5eace
SHA512 344fe594cbadf9a8812b5e7c27a0e2d5d25728b1f16df009a84ac9ff4044f84e6ebeeff2b867a5c9876ac2532fbed994efb48cdb1c73b37ae7c8f39858fa9236
SSDEEP 3072:c5BuYAVrgUCPnN45zOZwAs9ThFEYSnjR1n0a3M1PQNIXyBWy23RPms6CJ1:c50gUClEO0PFdu1nrOyBX231mU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NSISArray.dll

IMPHASH 812688d08c0d4a81ed86daeebcf15c55
SHA256 a8c486730810c55c337c7d6863243fad25c212b4d11ceeceb420c4b2c131a605
MD5 5ae0c62802120e2fa971959795581daf
SHA1 e0c2d66ba75b41f8e22ff31c90986e572735429f
SHA512 e09b14c1eef4c3962f18307df4abf4fbb62710dbf3cde80346069861b4db63e72b0441e0136921290725632f6c21b3916920e928f4df63b3f5c0e78b8e750101
SSDEEP 384:Z9fln0eNNe1AT+i1RSHKrsc+fDA9rFC7amgKFR1qjMzyJ:zCyg1AT+KRSHKrHrkJg81qd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4851

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 02b159edf117c48e4627963b151d3e5b
SHA256 e554d904b4903c74035772b4b20cb7cc508f7d27bfee79f424f29ad31d4caf59
MD5 bd30dd24c0084fd883949bdbdca225e2
SHA1 fddf52a9d22a6e614e202a0c55deb5752f4595eb
SHA512 4d24c9160caaa8f3b0ca5ae13a8fc64d9c0fe722c274f63aa4c2d7379f8e4aa5bcdad45e49b62ad928d7bb759657e4a4915327fab0728ffd20dc838a4b6811e5
SSDEEP 384:2SL4Q/u6Sfzh26IynPnS2jJkvcltWfAkVa9h9mTuu4CYHaZwcnCJUh7nXl+:2qR36I+KsJkQWAaajYTuHfGnV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16387

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

wcstol strrchr wcschr wcsrchr wcsstr memset strchr wcstoul strlen _encode_pointer _malloc_crt free _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook _except_handler4_common _onexit _lock __dllonexit _unlock __clean_type_info_names_internal

wininet

HttpEndRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetErrorDlg InternetCloseHandle HttpAddRequestHeadersA InternetQueryOptionW InternetSetOptionW InternetSetFilePointer InternetGetLastResponseInfoW FtpOpenFileW FtpCreateDirectoryW HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetWriteFile InternetReadFile InternetConnectW InternetCrackUrlW InternetOpenW

comctl32

ord17

kernel32

GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW GetSystemTimeAsFileTime LoadLibraryW GetProcAddress lstrcmpiW CreateFileW GetFileSize lstrcatW GetTickCount SetFilePointer SleepEx CloseHandle DeleteFileW GetLastError lstrcmpW ReadFile WriteFile lstrlenW GlobalAlloc lstrcpynW lstrcpyW GlobalFree MulDiv

user32

GetWindowTextW wsprintfA MapDialogRect FindWindowExW CreateDialogParamW EnableWindow IsWindowVisible IsDialogMessageW GetMessageW TranslateMessage DispatchMessageW RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconW SetTimer wsprintfW IsWindow MessageBoxW GetParent ShowWindow SetWindowLongW GetWindowLongW SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowRect SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect

gdi32

DeleteObject SetBkMode CreateSolidBrush

$PLUGINSDIR/newadvsplash.dll

IMPHASH 7efb019e000b6e0291c32d00fe622590
SHA256 0a70cc4b93d87ecd93e538cfbed7c9a4b8b5c6f1042c6069757bda0d1279ed06
MD5 55a723e125afbc9b3a41d46f41749068
SHA1 01618b26fec6b8c6bdb866e6e4d0f7a0529fe97c
SHA512 559157fa1b3eb6ae1f9c0f2c71ccc692a0a0affb1d6498a8b8db1436d236fd91891897ac620ed5a588beba2efa43ef064211a7fcadb5c3a3c5e2be1d23ef9d4c
SSDEEP 96:/VV0Rwtvrm2nQujIvP9dir3UniV/zRzVR3rN3k8Jd18tsPcaqhx:/VV0KtC2yH9d83BzVR53kEQFaq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/version.dll

SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
MD5 ebc5bb904cdac1c67ada3fa733229966
SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 12a0c008b207d7e546e8f7a4030b25a999d745dc15a174b4d305763a4df6ab12
MD5 aa05c546875238a55566cc34e4ab55be
SHA1 8a8e0b2343036a9ed24bb8480edd4c262808e2e4
SHA512 52d1f35ae2e810f6c4ddb1f0b4a0889c658d1bdac33cf69b6700a1d4f94d9b040900b52513fc66916094198f003ef94be299e115346b28778fa545b31a6cdad7
SSDEEP 192:nro24pvm8S8dNr0Q+7y5cdFx8Jf/DHFKSr9C:SPnV1Z55JHDHrk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cae64c3e1f8902578ffe056aee311129e7cb1ad9b8f0c0de15484ed304d4c581N

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISArray.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcr90

wininet

comctl32

kernel32

user32

gdi32

generic

$PLUGINSDIR/newadvsplash.dll

kernel32

user32

gdi32

winmm

oleaut32

msvcrt

generic

$PLUGINSDIR/splash.gif

$PLUGINSDIR/version.dll

generic

out.upx

generic