629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370

Sharing

Copy URL Twitter E-mail

General

Target
629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370
Size 529KB
Sample241120-y3tfmaxkdr
SHA256 629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370
MD5 d2edd9ae391a3a0b8ce194e31b38c780
SHA1 033d62602d22f793131cf19f4bc18e0f7326e93b
SHA512 5937ce5bc124aa6dcb9d8ed1f0d2d9384a2a504bdd8b7de217ed1342e85bcc86c0863d0dc817932916fa6b8fde27418500e31eb4dfb2cd610a7980e57e34a8dd
SSDEEP 6144:CvmTyW3ZBck+bvI0dfzJoQ/hVOjkIrkYK3GK6VWWOI0edWx7IBq9B:Cw09X38GGtWWOwdWlIB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370

File Explorer

629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370

.dll 529KB

629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370

IMPHASH dd552575e0cf9d6f021ffe8e0937be8a
SHA256 629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370
MD5 d2edd9ae391a3a0b8ce194e31b38c780
SHA1 033d62602d22f793131cf19f4bc18e0f7326e93b
SHA512 5937ce5bc124aa6dcb9d8ed1f0d2d9384a2a504bdd8b7de217ed1342e85bcc86c0863d0dc817932916fa6b8fde27418500e31eb4dfb2cd610a7980e57e34a8dd
SSDEEP 6144:CvmTyW3ZBck+bvI0dfzJoQ/hVOjkIrkYK3GK6VWWOI0edWx7IBq9B:Cw09X38GGtWWOwdWlIB
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

gdiplus

GdipCreateSolidFill GdipDisposeImage GdipDrawImageI GdipDrawLineI GdipDeletePen GdipCreatePen1 GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillRectangleI GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateLineBrushFromRectI GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipGetVisibleClipBoundsI GdipDeleteGraphics GdipCreateFromHDC GdiplusStartup GdipCloneImage GdipAlloc

crypt32

CryptStringToBinaryA

kernel32

LCMapStringW HeapSize GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount GetConsoleMode GetConsoleCP MultiByteToWideChar HeapDestroy SetFilePointer CreateThread GetCommandLineW GetVersionExA CreateToolhelp32Snapshot GetLastError GetCurrentProcessId Process32First Process32Next CloseHandle VirtualAlloc CreateMutexA WaitForSingleObject ReleaseMutex SetThreadExecutionState DeviceIoControl FormatMessageW Sleep CreateFileW GetFileInformationByHandle FlushFileBuffers GetSystemTime FindFirstFileW FindNextFileW FindClose GetSystemTimeAsFileTime GetFileAttributesExW GetCurrentProcess GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW GetDriveTypeW GetVolumeInformationW FindFirstVolumeMountPointW FindNextVolumeMountPointW FindVolumeMountPointClose GetLogicalDriveStringsW GetModuleFileNameW GetShortPathNameW GetLongPathNameW DosDateTimeToFileTime LocalFileTimeToFileTime ReadFile GetStdHandle WriteFile RtlUnwindEx HeapSetInformation LoadLibraryW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetStringTypeW FlsAlloc SetLastError FlsFree SetStdHandle WriteConsoleW SetEndOfFile GetProcessHeap CompareStringW SystemTimeToFileTime SetEnvironmentVariableA FlsGetValue IsValidCodePage HeapCreate GetVersion GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapAlloc GetTimeZoneInformation HeapFree HeapReAlloc DeleteFileW GetCurrentThreadId FlsSetValue GetCommandLineA RaiseException RtlPcToFileHeader TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer WideCharToMultiByte GetCPInfo GetACP GetOEMCP

user32

DefWindowProcA EndPaint BeginPaint InvalidateRect PostQuitMessage DispatchMessageA TranslateMessage GetMessageA SetTimer UpdateWindow CreateWindowExW MessageBoxW RegisterClassExA LoadIconA LoadCursorA ShowWindow LoadStringA

gdi32

GetStockObject

advapi32

RegQueryValueExW RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey

shell32

CommandLineToArgvW

ole32

CoLoadLibrary

Sharing

General

Malware Config

Signatures

File Explorer

629b3530d8d61d8338df2e3d5dc88b26641560e2393baa2a02c2bb3d1a195370

gdiplus

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

generic