9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2.exe
Size 4.8MB
Sample241111-rwxfda1apf
SHA256 9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2
MD5 c3e3f4d255d0966c8b2933cffbccdcb0
SHA1 ef4ca18586789505b95ceacda9679ddb01f1b5aa
SHA512 7a75b2cf6e348b20cc3027dfd8feae382bba9532b0778fabc5690d90728d95c8f9981a014fb2506169fc059338c73dcd067b3434f409720017f7f46b70c0627d
SSDEEP 98304:raTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukX:raTiZ7qfRmp3QZ6/+9Fu/v0AmWhX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2.exe

File Explorer

9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2.exe

.dll 4.8MB

9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2.exe

IMPHASH b83cdc2d1260b7d6104ddd7f9272ead4
SHA256 9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2
MD5 c3e3f4d255d0966c8b2933cffbccdcb0
SHA1 ef4ca18586789505b95ceacda9679ddb01f1b5aa
SHA512 7a75b2cf6e348b20cc3027dfd8feae382bba9532b0778fabc5690d90728d95c8f9981a014fb2506169fc059338c73dcd067b3434f409720017f7f46b70c0627d
SSDEEP 98304:raTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/ukX:raTiZ7qfRmp3QZ6/+9Fu/v0AmWhX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4919296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

g:\Acro_root_at\bravo\public\libraries\windows\release\dynamic\agm4crtstdll\AGM.pdb

kernel32

GlobalSize GetVersionExA GetSystemInfo GetTickCount GetModuleHandleA GetTimeFormatA LocalAlloc InterlockedExchange RaiseException Sleep InterlockedCompareExchange TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetWindowsDirectoryA GetCurrentDirectoryA GetFileSize ReadFile SetCurrentDirectoryA IsProcessorFeaturePresent GetProfileStringA GlobalFree GlobalAlloc GlobalUnlock GlobalLock GetSystemDefaultLCID GetLocaleInfoA GetACP CreateFileA GetFileTime CloseHandle GetLastError FindFirstFileA FindNextFileA FindClose GetUserDefaultLangID FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryA GetDateFormatW GetTimeFormatW GetThreadLocale GetDateFormatA

user32

CharNextA GetDesktopWindow GetActiveWindow SetActiveWindow OffsetRect GetMonitorInfoA MonitorFromWindow MonitorFromPoint ScrollWindowEx UnregisterClassA LoadIconA LoadCursorA RegisterClassA SetWindowPos CreateWindowExA DestroyWindow DefWindowProcA WindowFromDC GetWindowRect GetDC ReleaseDC GetClientRect GetSystemMetrics

gdi32

ResetDCA CreateDCA ExtEscape StartPage StartDocA AbortDoc EndPage EndDoc SetMiterLimit ExtCreatePen GetCurrentObject Escape PolyDraw SelectClipPath IntersectClipRect GetClipBox Rectangle FillPath BeginPath EndPath SetGraphicsMode GetGraphicsMode GetWorldTransform ModifyWorldTransform StrokePath SetWorldTransform MoveToEx PolyBezierTo CloseFigure PolylineTo LineTo GetStockObject SetPolyFillMode StretchBlt CreatePalette CreateBrushIndirect PatBlt SelectPalette RealizePalette CreateDIBSection BitBlt GetDIBColorTable SelectClipRgn GetRegionData CreateRectRgn CombineRgn SaveDC ExtSelectClipRgn SetStretchBltMode StretchDIBits RestoreDC GetDeviceCaps CreateCompatibleBitmap GetObjectA DeleteObject DeleteDC SelectObject CreateCompatibleDC GetViewportOrgEx CreatePolyPolygonRgn

advapi32

RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantClear VariantInit

msvcp80

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_BADOFF@std@@3JB ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?to_int_type@?$char_traits@D@std@@SAHABD@Z ?to_char_type@?$char_traits@D@std@@SADABH@Z ?eq@?$char_traits@D@std@@SA_NABD0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z ?_Move_s@?$char_traits@D@std@@SAPADPADIPBDI@Z ?assign@?$char_traits@D@std@@SAXAADABD@Z ?_Xran@_String_base@std@@SAXXZ ?_Xlen@_String_base@std@@SAXXZ ?length@?$char_traits@D@std@@SAIPBD@Z ?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z ?_Move_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z ?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z ?length@?$char_traits@_W@std@@SAIPB_W@Z ?compare@?$char_traits@D@std@@SAHPBD0I@Z ?find@?$char_traits@D@std@@SAPBDPBDIABD@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$char_traits@D@std@@SAPADPADID@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?good@ios_base@std@@QBE_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?width@ios_base@std@@QAEHH@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z ?eof@?$char_traits@D@std@@SAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBEHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z ?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?not_eof@?$char_traits@D@std@@SAHABH@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z

msvcr80

fseek _stricmp __clean_type_info_names_internal _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _CxxThrowException memset __CxxFrameHandler3 memcpy ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ _invalid_parameter_noinfo ??0exception@std@@QAE@ABV01@@Z __RTDynamicCast _purecall exit _control87 fclose malloc free qsort _CIsin _CIcos _CIpow _CIlog strstr _CIsqrt memmove_s wcstombs sscanf ferror fgetc fopen toupper memmove strncpy vsprintf rand ceil floor _CIfmod _CIlog10 _CIatan2 _hypot fread fwrite modf atoi strchr strncmp rename remove setbuf ftell fputs fflush feof isdigit freopen ungetc getc _ltoa strtok _strupr fprintf __iob_func calloc _CIatan realloc _unlock _encode_pointer __dllonexit _lock _onexit _decode_pointer ?terminate@@YAXXZ _except_handler4_common _malloc_crt

shlwapi

PathAppendA PathRemoveFileSpecA

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

131KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

115KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

9c96a3460dcec9d206e695c9595108aaddde6f33ba6f8067ac19d492f87712f2.exe

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp80

msvcr80

shlwapi

generic