b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe
Size 13.3MB
Sample260506-fd153aew2n
SHA256 b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1
MD5 156b6073e2391e2bff64fdd098f2aab9
SHA1 a6c754007e8a14b75aa62aeab50f579c0b68ca0a
SHA512 6a064f40b722256f94341380a949283c48ca0eafe23440dc34927cd416762d61b052768dd31f4775e9457428d2dba3d1d3eeb69655ff30edec10129eb1c4182f
SSDEEP 393216:u9iXfqWfWw9BJIPJhlm7dzfT2vrszY/Brv0:u5WOaB4I792sYa
TLSH
T1F4E6E101F5C14165D85B317B791A6B3EBB35AB114B308AC7E2887DA87FB02D2673924F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe

.exe 13.3MB
$APPDATA/comain_ev2f79/$R1

1.9MB
$PLUGINSDIR/DcryptDll.dll

.dll 20KB
$PLUGINSDIR/nsExec.dll

.dll 7KB

b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1
MD5 156b6073e2391e2bff64fdd098f2aab9
SHA1 a6c754007e8a14b75aa62aeab50f579c0b68ca0a
SHA512 6a064f40b722256f94341380a949283c48ca0eafe23440dc34927cd416762d61b052768dd31f4775e9457428d2dba3d1d3eeb69655ff30edec10129eb1c4182f
SSDEEP 393216:u9iXfqWfWw9BJIPJhlm7dzfT2vrszY/Brv0:u5WOaB4I792sYa
TLSH
T1F4E6E101F5C14165D85B317B791A6B3EBB35AB114B308AC7E2887DA87FB02D2673924F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/DcryptDll.dll

IMPHASH d10a3474df08413bb121ee319f4987e9
SHA256 ad313f94da4ab0980173e60cbda7d1510e92fb49d2359224e0f89dc3ec0584e7
MD5 0a5e967b684d6f3db31cffb619cc0222
SHA1 2ed62db69f3ef5b0294805e326e3f41e5b3b0ac5
SHA512 9cf83f8827aafba394befe1a7c91cf6e12ccadc0767fd1934a823e951b6b6cb24ecf7ee56a4c012c162a41900de0c5f1820ca6fd6836bc474881d9f23e966954
SSDEEP 384:k3tsJOACduC6f6o14y5+UKjNLUtTQdCLXXCBwnp:k3tsJOhuDC44y5uLEeCLXSBwnp
TLSH
T1E492D750CAD10420E0B322BA7AF955129CF87E321836610FFEB7065B6D78AD76767732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

b0fb185461618e82915e7d701fc6dbe6164c45a7605f3110aff41ebc5c8447b1.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$APPDATA/comain_ev2f79/$R1

$PLUGINSDIR/DcryptDll.dll

kernel32

user32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic