6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076

Sharing

Copy URL Twitter E-mail

General

Target
6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076
Size 2.1MB
Sample260503-va5ready2w
SHA256 6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076
MD5 3bf59676c87b5b6b01095bdc08be221f
SHA1 ca2f46e28a401dc5f96f191a29640b9ff44ba2d9
SHA512 9274ffaca7fb58eea78c38e0182f382c249f7ac0e86683e0e1e3e47efa793a50c5608b64e458be3132b3f861d28e34cb515879775251ba5d380b9fb2b6eda2b5
SSDEEP 24576:p4L76gxUf1b60oXSJ3lZqTOSyXBmd4jjonBs5ijNu2MNcxrfDQ8K5fFE4f3m:p9gxUf1bfrmdnnBs0kSD3gfq4+
TLSH
T102A58D13F15294F1E22D117512B1233E9979A6624E218A63FFD4DEF4AC322E2D79360F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076

File Explorer

6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076

.dll 2.1MB

6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076

IMPHASH 40d61fcd71f4fe6851b4717b6866aa23
SHA256 6825298a40757be34f1c66a1c551822bf28caa5b1f399d730556012899e29076
MD5 3bf59676c87b5b6b01095bdc08be221f
SHA1 ca2f46e28a401dc5f96f191a29640b9ff44ba2d9
SHA512 9274ffaca7fb58eea78c38e0182f382c249f7ac0e86683e0e1e3e47efa793a50c5608b64e458be3132b3f861d28e34cb515879775251ba5d380b9fb2b6eda2b5
SSDEEP 24576:p4L76gxUf1b60oXSJ3lZqTOSyXBmd4jjonBs5ijNu2MNcxrfDQ8K5fFE4f3m:p9gxUf1bfrmdnnBs0kSD3gfq4+
TLSH
T102A58D13F15294F1E22D117512B1233E9979A6624E218A63FFD4DEF4AC322E2D79360F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1013670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

midiStreamOpen midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty waveOutWrite midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart

ws2_32

htons socket setsockopt recvfrom WSAAsyncSelect connect getservbyname ntohs WSAGetLastError shutdown closesocket send WSACleanup WSAStartup gethostbyname inet_ntoa inet_addr accept getpeername ntohl recv ioctlsocket

kernel32

SetLastError GetTimeZoneInformation GetLocaleInfoA GetVersion TerminateThread CreateMutexA ReleaseMutex SuspendThread SetNamedPipeHandleState WaitNamedPipeA UnmapViewOfFile GetWindowsDirectoryA OpenFileMappingA OpenEventA TlsAlloc TlsFree TlsSetValue TlsGetValue InterlockedIncrement InterlockedDecrement VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA SetEnvironmentVariableW VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetACP HeapSize RaiseException GetLocalTime GetSystemTime RtlUnwind GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime LocalReAlloc GlobalHandle LocalAlloc lstrcmpA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers DuplicateHandle lstrcpynA FileTimeToLocalFileTime FileTimeToSystemTime LocalFree TerminateProcess GetCurrentProcess GetFileSize SetFilePointer CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose GetFileAttributesA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsValidLocale IsValidCodePage EnumSystemLocalesA CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle GetLocaleInfoW InterlockedExchange MapViewOfFile

user32

GetClassInfoA DefWindowProcA IsZoomed PostQuitMessage CopyAcceleratorTableA GetKeyState TranslateAcceleratorA IsWindowEnabled ShowWindow SystemParametersInfoA LoadImageA EnumDisplaySettingsA CreateMenu ModifyMenuA AppendMenuA CreatePopupMenu DrawIconEx CreateIconFromResource CreateIconFromResourceEx RegisterClipboardFormatA SetRectEmpty DispatchMessageA GetMessageA WindowFromPoint ClientToScreen EnableMenuItem DrawFocusRect DrawEdge DrawFrameControl TranslateMessage LoadIconA GetDesktopWindow GetClassNameA GetDlgItem GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer GetWindowTextA GetSubMenu GetDlgCtrlID CreateAcceleratorTableA CallWindowProcA CreateWindowExA RegisterHotKey ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle UnregisterHotKey GetSysColorBrush LoadStringA UnregisterClassA GetMenuCheckMarkDimensions GetMenuState SetMenuItemBitmaps GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetForegroundWindow GetLastActivePopup GetMessageTime RemovePropA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem

gdi32

SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage OffsetViewportOrgEx CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CreateRectRgnIndirect SetBkColor CreateFontA TranslateCharsetInfo SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits BitBlt EndPath RealizePalette

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegOpenKeyExA RegSetValueExA RegQueryValueA RegEnumValueA RegCreateKeyExA RegCloseKey

shell32

DragFinish Shell_NotifyIconA DragQueryFileA ShellExecuteA DragAcceptFiles

ole32

OleInitialize OleUninitialize CLSIDFromString CoCreateInstance OleRun CLSIDFromProgID

oleaut32

UnRegisterTypeLi LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayPutElement SafeArrayCreate SafeArrayDestroy SysAllocString VariantInit VariantCopyInd SafeArrayGetElement SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound VariantChangeType VariantClear VariantCopy

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_EndDrag ord17

comdlg32

GetSaveFileNameA ChooseColorA GetFileTitleA GetOpenFileNameA

generic

count=14, id=12, version=7291,

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=44, id=14, version=7299,

count=44, id=19, version=8022,

count=1, id=11, version=8966,

count=84, id=10, version=8966,

count=24, id=19, version=8034,

count=688, id=1, productName=Unmarked objects,

count=3, id=93, version=2179,

count=1, id=18, version=8444,

count=107, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=257, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=92, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=55, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,