d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901N

Sharing

Copy URL Twitter E-mail

General

Target
d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901N
Size 6.7MB
Sample241111-mrwwtsyarn
SHA256 d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901
MD5 f656dd553ff33ff8270de3dc51edf0b0
SHA1 58bf3f244546b7ceb18563a5d180bc9d49532476
SHA512 0e5aace5985c7cc5688a81d662b8b7ea710688fd522b8ab6ececc1ea2576a1d9663303f85c31d645cb6e5bfeed4549badcb5fac29ad279e3f632f7c9cba6a60a
SSDEEP 49152:D3QVGCKKFwbbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAR/gRE3RhgJIC9weS6Z:D3QwCKmsN1qBkJajAFj64/gZ85XH9jM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901N

File Explorer

d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901N

.exe 6.7MB

d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901N

IMPHASH e39d31926c2a9a61bce453bce5997787
SHA256 d44e65d6d8a8d40223b76136e0a3ab21c61ebd7eff2aa8eb89215fdb4ff09901
MD5 f656dd553ff33ff8270de3dc51edf0b0
SHA1 58bf3f244546b7ceb18563a5d180bc9d49532476
SHA512 0e5aace5985c7cc5688a81d662b8b7ea710688fd522b8ab6ececc1ea2576a1d9663303f85c31d645cb6e5bfeed4549badcb5fac29ad279e3f632f7c9cba6a60a
SSDEEP 49152:D3QVGCKKFwbbZzOIniBJy0BK7JHCRrdfOzsOaR0IxEgkUAR/gRE3RhgJIC9weS6Z:D3QwCKmsN1qBkJajAFj64/gZ85XH9jM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2713993

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentDirectoryA GetFullPathNameA GetConsoleMode SetConsoleMode ReadConsoleInputA FileTimeToLocalFileTime FileTimeToSystemTime IsBadCodePtr IsBadReadPtr SetConsoleCtrlHandler RaiseException FlushConsoleInputBuffer lstrlenA GetLocaleInfoA VirtualProtect SetStdHandle SetEnvironmentVariableA GetOEMCP GetACP CompareStringW GetCPInfo CompareStringA VirtualQuery InterlockedExchange GetStringTypeW LCMapStringW LCMapStringA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy RtlUnwind HeapReAlloc ExitProcess GetCommandLineA GetStartupInfoA GetSystemTimeAsFileTime HeapAlloc HeapFree SetLastError GetModuleHandleA MoveFileExA LocalAlloc LocalLock LocalUnlock LocalFree GetSystemInfo GlobalMemoryStatus GetWindowsDirectoryA GetDriveTypeA GetVolumeInformationA GetTimeZoneInformation GetSystemDefaultLangID GetSystemDefaultLCID GetComputerNameA GetCurrentThreadId GetTickCount GetVersion GetSystemDirectoryA SetEndOfFile FlushFileBuffers WriteFile UnlockFile LockFile ReadFile SetFilePointer FindResourceA LoadResource LockResource SizeofResource GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetVersionExA FreeLibrary GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA SetErrorMode LoadLibraryA GetProcAddress GetProfileStringA InterlockedDecrement CreateProcessA RemoveDirectoryA GetExitCodeProcess OpenProcess TerminateProcess CreateEventA ResetEvent CreateFileMappingA MapViewOfFile WaitForSingleObject GetCurrentProcess DuplicateHandle Beep CreateFileA GetFileSize CloseHandle GetDiskFreeSpaceA FindFirstFileA FindNextFileA FindClose GetLastError SetFileAttributesA MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter DeleteFileA Sleep CreateDirectoryA GetStringTypeA

user32

PeekMessageA GetQueueStatus GetMessageA DestroyWindow GetClientRect SetFocus ShowWindow CreateWindowExA GetSystemMetrics SystemParametersInfoA RegisterClassA LoadCursorA LoadIconA wsprintfA ReleaseDC DrawIcon GetWindowDC TranslateMessage GetWindowLongA SetWindowLongA EndPaint BeginPaint DefWindowProcA FillRect SetRect MessageBoxA GetKeyboardState GetDC EnumDisplaySettingsA ShowCaret SetCaretPos CreateCaret HideCaret EnumWindows SendMessageA InvalidateRect DispatchMessageA SetWindowPos PtInRect GetWindowThreadProcessId PostMessageA WaitForInputIdle KillTimer LoadImageA SetTimer FrameRect CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetKeyState SetScrollPos GetFocus GetUpdateRect PostQuitMessage GetCursorPos RegisterClassExA SetScrollInfo ShowScrollBar UpdateWindow GetDesktopWindow

winspool.drv

ClosePrinter EndDocPrinter StartDocPrinterA WritePrinter StartPagePrinter EndPagePrinter OpenPrinterA DocumentPropertiesA DeviceCapabilitiesA

gdi32

LineTo PaintRgn GetObjectA CreateHalftonePalette GetDIBColorTable CreatePalette SelectPalette RealizePalette PtInRegion EndDoc AbortDoc StartDocA GetEnhMetaFileBits DeleteEnhMetaFile EndPage StartPage Escape SetTextCharacterExtra PatBlt MoveToEx GetTextMetricsA StretchBlt SetStretchBltMode GetTextExtentPointA SetTextAlign CreateBitmap SetBkMode GetRgnBox SelectClipRgn FrameRgn BitBlt CreateFontIndirectA SetTextColor CreatePen SetBkColor CreateSolidBrush SelectObject DeleteObject GetStockObject CreateCompatibleDC GetDeviceCaps DeleteDC CreateRectRgn SetRectRgn CombineRgn CreateEnhMetaFileA CreateCompatibleBitmap CreateDCA PlayEnhMetaFile SetEnhMetaFileBits GetEnhMetaFileHeader GetDIBits SetTextJustification TextOutA CloseEnhMetaFile

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetQueryDataAvailable HttpQueryInfoA HttpEndRequestA InternetAttemptConnect InternetWriteFile HttpSendRequestExA InternetQueryOptionA InternetCrackUrlA InternetCanonicalizeUrlA InternetCreateUrlA InternetSetOptionA InternetCloseHandle FtpOpenFileA InternetSetFilePointer InternetReadFile

wsock32

gethostbyname ioctlsocket ntohs htonl closesocket connect recv send WSAGetLastError htons shutdown WSASetLastError accept WSAAsyncSelect WSACleanup WSAStartup socket inet_addr gethostbyaddr getsockname ntohl

odbc32

ord75 ord41 ord11 ord36 ord18 ord16 ord14 ord15 ord13 ord4 ord27 ord24

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptReleaseContext CryptGenRandom RegEnumValueA RegEnumKeyExA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetKeySecurity RegSetValueExA RegDeleteKeyA RegCreateKeyExA CryptAcquireContextA

rpcrt4

UuidFromStringA

rasapi32

RasHangUpA

ole32

CoInitialize CoCreateGuid CoCreateInstance CLSIDFromProgID CoUninitialize

oleaut32

SysAllocString VariantClear GetErrorInfo VariantInit SysFreeString

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

88KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

144KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=3, id=15, productName=VS2003 (.NET) build 3077, version=3077,

count=5, id=96, productName=VS2003 (.NET) build 3077, version=3077,

count=2, id=95, version=2179,

count=13, id=28, productName=VS2002 (.NET) build 9466, version=9466,

count=1, id=14, version=7299,

count=5, id=105, version=2067,

count=243, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=1, id=96, version=2179,

count=2, id=28, version=9177,

count=2, id=25, version=9111,

count=2, id=93, version=2067,

count=23, id=93, version=2179,

count=343, id=1, productName=Unmarked objects,

count=157, id=95, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=34, id=15, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=372, productName=Unmarked objects (old),

count=408, id=96, productName=VS2003 (.NET) SP1 build 6030, version=6030,

count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,

count=1, id=90, productName=VS2003 (.NET) SP1 build 6030, version=6030,