dynowiper | 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b[.]exe

General

Target
60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe
Size 163KB
Sample260209-phl2dadz7a
SHA256 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b
MD5 75fec5afb2deebab6dd9c16d9de35032
SHA1 86596a5c5b05a8bfbd14876de7404702f7d0d61b
SHA512 2be0a6a4a0f86abc64ab1c4f229725e2676639681e3314a264ab106c20e86cf50c65d1d95ebbcf33790d77be2841ef1c39829f1247700798f1001aff5684ca19
SSDEEP 1536:RI5x+cpS8+c48t3UjpGyAgGsu0X55l1tSsHGVIdWQe7AtaCxc2BGywukCbg+DjcX:R2Sz8tkNn9/Nc3mECxd8iD9yUS7vV8E
TLSH
T1FBF35A1276D0C071E573427609F8AB354A7EBD620F625ADBB7C80B4D0AB41D1AB367B3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

dynowiper

Malware Config

Signatures

Detects DynoWiper payload 1 IoCs

resource	yara_rule
sample	family_dynowiper

Dynowiper family
dynowiper

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe

File Explorer

60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe

.exe 163KB

60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b.exe

IMPHASH 442f0433cab730d959ae308f5c6f0f30
SHA256 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4b
MD5 75fec5afb2deebab6dd9c16d9de35032
SHA1 86596a5c5b05a8bfbd14876de7404702f7d0d61b
SHA512 2be0a6a4a0f86abc64ab1c4f229725e2676639681e3314a264ab106c20e86cf50c65d1d95ebbcf33790d77be2841ef1c39829f1247700798f1001aff5684ca19
SSDEEP 1536:RI5x+cpS8+c48t3UjpGyAgGsu0X55l1tSsHGVIdWQe7AtaCxc2BGywukCbg+DjcX:R2Sz8tkNn9/Nc3mECxd8iD9yUS7vV8E
TLSH
T1FBF35A1276D0C071E573427609F8AB354A7EBD620F625ADBB7C80B4D0AB41D1AB367B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Detects DynoWiper payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

33270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\vagrant\Documents\Visual Studio 2013\Projects\Source\Release\Source.pdb

kernel32

GetFileSize FindFirstFileW GetDriveTypeW SetFilePointerEx GetLogicalDrives WriteFile WideCharToMultiByte Sleep CreateFileW MultiByteToWideChar GetConsoleOutputCP FindClose SetConsoleOutputCP FindNextFileW CloseHandle DeleteFileW SetFileAttributesW GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLastError HeapFree GetCommandLineA GetCPInfo RaiseException RtlUnwind HeapAlloc FreeLibrary GetProcAddress LoadLibraryExW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent GetProcessHeap ExitProcess GetModuleHandleExW HeapSize IsValidCodePage GetACP GetOEMCP GetCurrentThreadId GetStdHandle GetFileType GetModuleFileNameA GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile HeapReAlloc OutputDebugStringW SetStdHandle WriteConsoleW ReadConsoleW

Sharing