8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f

Sharing

Copy URL Twitter E-mail

General

Target
8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f
Size 1.6MB
Sample260416-rm299sc191
SHA256 8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f
MD5 215f4a1987d31cee227a86e6e2062deb
SHA1 fcf37257cec3836a60637ca7dd8ba92a0cad4246
SHA512 db5596c22c424091fe974b3fa9f703b3518419472c4d24e7fb0ca40d4f2d5c30655788e631eea148a2cf20031323bc3c4b38ac9839fee8aac062abec26a33d68
SSDEEP 24576:gauefiRGbOmP/Is7ltn+XbhHaxJN7pSm3QRv7WGgsANdKqVpX9DuOC6Z:fussGFjlN2N0R3QRyNdKqVpX9k6
TLSH
T1DA85AE12B7828073F9F309B195BA87BE8539B920172494D3E3D44D198E726E07F3676B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f

File Explorer

8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f

.exe 1.6MB

8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f

IMPHASH 8f91a91067f5306c855b6ce83bc9927d
SHA256 8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f
MD5 215f4a1987d31cee227a86e6e2062deb
SHA1 fcf37257cec3836a60637ca7dd8ba92a0cad4246
SHA512 db5596c22c424091fe974b3fa9f703b3518419472c4d24e7fb0ca40d4f2d5c30655788e631eea148a2cf20031323bc3c4b38ac9839fee8aac062abec26a33d68
SSDEEP 24576:gauefiRGbOmP/Is7ltn+XbhHaxJN7pSm3QRv7WGgsANdKqVpX9DuOC6Z:fussGFjlN2N0R3QRyNdKqVpX9k6
TLSH
T1DA85AE12B7828073F9F309B195BA87BE8539B920172494D3E3D44D198E726E07F3676B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

947566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar WideCharToMultiByte FreeLibrary GetSystemDirectoryW UnmapViewOfFile GetVersionExW GetDriveTypeW SleepEx GetStdHandle GetFileType GetCurrentThreadId GetModuleHandleA QueryPerformanceCounter GlobalMemoryStatus LoadLibraryA FlushConsoleInputBuffer InterlockedDecrement InterlockedIncrement DuplicateHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoW InitializeCriticalSection PeekNamedPipe ExpandEnvironmentStringsA FormatMessageA SetConsoleCtrlHandler SetEnvironmentVariableA SystemTimeToTzSpecificLocalTime FindFirstFileExW SetStdHandle ReadConsoleW FlushFileBuffers GetConsoleCP GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetFileInformationByHandle SetFilePointerEx SetConsoleMode ReadConsoleInputA GetConsoleMode AreFileApisANSI ExitProcess IsProcessorFeaturePresent GetTimeZoneInformation LoadLibraryExW ExitThread CreateThread GetSystemTimeAsFileTime GetFullPathNameW WriteConsoleW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW ProcessIdToSessionId GetStartupInfoW LocalFree TerminateProcess OpenProcess QueryDosDeviceW GetCurrentDirectoryW CreateProcessW ResumeThread LoadLibraryW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetCurrentProcess GetProcAddress FindResourceExW GetTickCount ExpandEnvironmentStringsW SetEndOfFile GetPrivateProfileStringW GetLocalTime FileTimeToSystemTime FileTimeToLocalFileTime ReadFile GetTempPathW DecodePointer GetFileSize FindClose SetFileAttributesW DeleteFileW MoveFileExW SizeofResource LockResource LoadResource FindResourceW WriteFile CreateFileW CreateDirectoryW lstrcpynW GetFileAttributesW GetModuleFileNameW CreateEventW WaitForSingleObject ResetEvent SetEvent InterlockedCompareExchange InterlockedExchange SetDllDirectoryW GetCommandLineW GetModuleHandleW CreateMutexW CloseHandle Sleep DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError GetModuleHandleExW GetStringTypeW EncodePointer OutputDebugStringW IsDebuggerPresent GetCurrentProcessId RaiseException GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy

user32

PostMessageW CallWindowProcW SendMessageTimeoutW FindWindowA CreateWindowExW IsWindow DestroyWindow GetWindowLongW SetWindowLongW FindWindowW CreateDesktopW GetMessageW TranslateMessage DispatchMessageW SetTimer KillTimer DefWindowProcW PeekMessageW GetWindowThreadProcessId MessageBoxA SendMessageW GetUserObjectInformationW GetProcessWindowStation

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx DeleteService ControlService StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW CreateServiceW CloseServiceHandle ChangeServiceConfig2W CryptDestroyKey CryptEncrypt CryptImportKey CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext CryptAcquireContextW CryptGetHashParam ReportEventA RegisterEventSourceA DeregisterEventSource RegQueryValueExW RegOpenKeyExW RegCloseKey CreateProcessAsUserW GetTokenInformation DuplicateTokenEx OpenProcessToken

shell32

SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteW

shlwapi

PathFileExistsW StrCmpNIW PathRemoveFileSpecW PathAppendW PathAddBackslashW StrToIntExW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

iphlpapi

GetAdaptersInfo

wininet

HttpOpenRequestW HttpQueryInfoW HttpAddRequestHeadersW InternetSetStatusCallbackW InternetCloseHandle HttpSendRequestW InternetReadFileExA InternetOpenW InternetCrackUrlW InternetConnectW

wldap32

ord167 ord208 ord145 ord147 ord79 ord26 ord41 ord127 ord118 ord27 ord301 ord46 ord142 ord133 ord14 ord216

ntdll

RtlUnwind

ws2_32

freeaddrinfo getaddrinfo listen accept __WSAFDIsSet WSAIoctl gethostname getpeername getsockname bind connect WSAGetLastError ntohs recvfrom sendto htons WSASetLastError select WSAStartup setsockopt ioctlsocket recv send WSACleanup closesocket socket getsockopt

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

334KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

srHvxieP

Size

89KB

Virtual Size

89KB

Characteristics

Name

CIhUgjkv

Size

3KB

Virtual Size

2KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

8d2c5699ceef5a11e52618933d4d182ee741a90a56ab35ee3fd8e610aa15541f

kernel32

user32

advapi32

shell32

shlwapi

wtsapi32

userenv

iphlpapi

wininet

wldap32

ntdll

ws2_32

generic