a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec

Sharing

Copy URL Twitter E-mail

General

Target
a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec
Size 2.1MB
Sample260424-eb8lpad151
SHA256 a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec
MD5 6419cc14b9140eed8b2f1bbed5221192
SHA1 c2fc87b6c0484144df3cd1539cccd3df57e09313
SHA512 86fc97866af462beaa54e09f6d0c66051ebbbd6a46dbc7d290c68048966491319ae22d3c6fdddd691c270a553485388cbfd91e010560bd5be5c3e93d498bb4b7
SSDEEP 24576:QhJVakfSnKfqy5RkPClBuaCE+iWDB/PnrXz4AR8MYu9jZxINYsuNbHoqXdXlxmDD:QuhVbHWDFmsMiaAb9rzqTCZBVY2
TLSH
T15CA5BF92F2D340B5C4E21A71015A733AE236BF0A0924D8D76B983F776F31651DF3929A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec

File Explorer

a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec

.exe 2.1MB

a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec

IMPHASH 5c6ac9058f94592924936fe1b9bd6339
SHA256 a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec
MD5 6419cc14b9140eed8b2f1bbed5221192
SHA1 c2fc87b6c0484144df3cd1539cccd3df57e09313
SHA512 86fc97866af462beaa54e09f6d0c66051ebbbd6a46dbc7d290c68048966491319ae22d3c6fdddd691c270a553485388cbfd91e010560bd5be5c3e93d498bb4b7
SSDEEP 24576:QhJVakfSnKfqy5RkPClBuaCE+iWDB/PnrXz4AR8MYu9jZxINYsuNbHoqXdXlxmDD:QuhVbHWDFmsMiaAb9rzqTCZBVY2
TLSH
T15CA5BF92F2D340B5C4E21A71015A733AE236BF0A0924D8D76B983F776F31651DF3929A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

444666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GlobalAlloc ResetEvent GlobalMemoryStatus GetLocalTime GlobalLock GlobalUnlock RemoveDirectoryA DeleteFileA CopyFileA CreateDirectoryA GetModuleHandleA FindNextFileA GetVersionExA GetTempFileNameA SetThreadIdealProcessor GetExitCodeProcess MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemDefaultLangID GetUserDefaultLangID GetSystemInfo CreateEventA HeapAlloc HeapFree HeapReAlloc SetFilePointer ReadFile ExitProcess TerminateProcess GetCurrentProcess InterlockedDecrement InterlockedIncrement GetFileType CreateFileA WriteFile ResumeThread CreateThread TlsSetValue ExitThread GetTimeZoneInformation GetSystemTime GetCurrentThreadId GetCommandLineA GetVersion GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc GetSystemDirectoryA RtlUnwind SetStdHandle SetHandleCount GetStdHandle GetCPInfo GetACP GetOEMCP LCMapStringA LCMapStringW TlsAlloc SetLastError TlsGetValue SetEndOfFile HeapSize UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetStringTypeA GetStringTypeW FlushFileBuffers RaiseException GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter GetCurrentProcessId GetProcessHeap IsProcessorFeaturePresent lstrcmpiA GetFullPathNameA InterlockedCompareExchange InterlockedExchange CreateFileW GetFileSize OutputDebugStringA FindClose GetStartupInfoA FindFirstFileA CreateProcessA GlobalFree lstrcpyA LoadLibraryA GetProcAddress WaitForMultipleObjects LeaveCriticalSection EnterCriticalSection FreeLibrary FindResourceA SizeofResource LoadResource LockResource FreeResource GetLastError GetModuleFileNameA GetFileAttributesA WideCharToMultiByte MultiByteToWideChar lstrlenA WaitForSingleObject SetEvent SetCurrentDirectoryA CreateMutexA CloseHandle Sleep ReleaseMutex DeleteCriticalSection InitializeCriticalSection IsBadWritePtr

user32

FillRect OpenIcon AdjustWindowRectEx SetRect GetWindowLongA SetWindowLongA RegisterClassExA SetWindowRgn GetClassNameA SendMessageTimeoutA IsWindowVisible SetWindowPlacement EnableWindow UpdateWindow MoveWindow CreateIconIndirect PostQuitMessage DefWindowProcA GetSystemMenu ChangeDisplaySettingsExA GetSystemMetrics EnumDisplaySettingsA DrawMenuBar InsertMenuItemA EndDialog EnumWindows SystemParametersInfoA ChangeDisplaySettingsA SetCursorPos SetMenu ShowCursor DestroyMenu DestroyWindow DestroyIcon LoadCursorA SetClassLongA ClientToScreen SetCursor GetWindowTextA DeleteMenu LoadIconA GetWindowRect CreateWindowExA RegisterClassA FindWindowA SetForegroundWindow GetDC ReleaseDC GetMessageA TranslateMessage DispatchMessageA SetFocus GetDlgItem GetWindowPlacement SetWindowTextA PeekMessageA GetKeyboardState SetKeyboardState GetCursorPos ScreenToClient PostMessageA ShowWindow GetSubMenu TrackPopupMenu RedrawWindow MessageBoxA IsIconic SendMessageA DialogBoxParamA GetClipboardData EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CreateMenu GetClientRect SetWindowPos

gdi32

SelectObject TextOutA CreateCompatibleDC CreateFontIndirectA SetBkMode SetTextColor CreateBitmap CreateSolidBrush ExtCreateRegion GetDIBits GetObjectA GetDeviceCaps DeleteObject DeleteDC GetStockObject SetStretchBltMode StretchDIBits CreateDIBSection EnumFontFamiliesExA

shell32

DragQueryFileA DragAcceptFiles Shell_NotifyIconA FindExecutableA ShellExecuteExA SHGetSpecialFolderPathA DragFinish

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA

comctl32

ord17

ole32

CoInitializeEx CoCreateInstance CoUninitialize

winmm

waveInGetNumDevs timeGetTime joyGetPosEx mciSendStringA waveInGetDevCapsA mmioStringToFOURCCA mmioOpenA waveOutGetDevCapsA waveOutGetNumDevs timeGetDevCaps timeBeginPeriod joyGetNumDevs timeEndPeriod mmioClose mciSendCommandA mmioAscend mmioDescend mmioRead

msacm32

acmStreamOpen acmStreamSize acmStreamPrepareHeader acmStreamConvert acmStreamUnprepareHeader acmStreamClose acmFormatSuggest

imm32

ImmAssociateContext

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

d3d9

Direct3DCreate9

dsound

ord1

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

158KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

117KB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data1

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

283KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a9c9f76afdbaab0d49ac797f52fcdf0d57b3245069119d63e5f63e0933bf96ec

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

winmm

msacm32

imm32

version

d3d9

dsound

generic