1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318

Sharing

Copy URL Twitter E-mail

General

Target
1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318
Size 249KB
Sample260508-ecdspsgt2n
SHA256 1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318
MD5 2858cacaefbd5fa5f27263843ae93e52
SHA1 f069e0709b6a486a7b668ed30ef736e2902ba778
SHA512 153427dd3927e7e50d883ae1ec73eb8913d9a39c1485e84f9dd0cd3ad6a90a9c847c1915fedb646b23b20a82bfcbd7da5e994bbea7b879e129967fdabd618ee5
SSDEEP 3072:8ga1mcahTEIFFyUvc407DW5T54450KCJMv6bZFX+a48J9fsAjbt51vv8w5DU41pT:Y0EINc40cTC4501Mvs7Xf0mFtvPPlXJ
TLSH
T1FB442A0072D1C835F8BB1D364ABD85594A6CBD601F55ECDBA3C4191E0EBA6E1EA30E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318

File Explorer

1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318

.dll 249KB

1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318

IMPHASH 40b15b91c188d3b48d8b9155f3a125f0
SHA256 1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318
MD5 2858cacaefbd5fa5f27263843ae93e52
SHA1 f069e0709b6a486a7b668ed30ef736e2902ba778
SHA512 153427dd3927e7e50d883ae1ec73eb8913d9a39c1485e84f9dd0cd3ad6a90a9c847c1915fedb646b23b20a82bfcbd7da5e994bbea7b879e129967fdabd618ee5
SSDEEP 3072:8ga1mcahTEIFFyUvc407DW5T54450KCJMv6bZFX+a48J9fsAjbt51vv8w5DU41pT:Y0EINc40cTC4501Mvs7Xf0mFtvPPlXJ
TLSH
T1FB442A0072D1C835F8BB1D364ABD85594A6CBD601F55ECDBA3C4191E0EBA6E1EA30E73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78853

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\work\DSE-V6-6.8.6-R2\Enterprise\bin\MgrDll.pdb

advapi32

ChangeServiceConfigA QueryServiceStatus QueryServiceConfig2A QueryServiceConfigA UnlockServiceDatabase RegCloseKey RegOpenKeyExA RegQueryValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA OpenServiceA CloseServiceHandle ControlService DeleteService EnumServicesStatusA LockServiceDatabase OpenSCManagerA StartServiceA

setupapi

SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDescriptionA SetupDiSetClassInstallParamsA SetupDiGetClassImageList SetupDiGetClassImageIndex SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstallParamsA SetupDiDestroyClassImageList CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdA

kernel32

WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle GetStringTypeW HeapSize SetFilePointerEx FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExA InterlockedExchange SetEvent WaitForSingleObject Sleep CloseHandle lstrcpyA GetProcAddress ResetEvent CreateEventA LoadLibraryA GetSystemDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemTimes DecodePointer LocalAlloc LocalFree RaiseException GetLastError InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA GetModuleHandleA OutputDebugStringA LocalReAlloc GetFileSize WriteFile ReadFile SetFilePointer FindClose lstrlenA GetDriveTypeA GetDiskFreeSpaceExA CreateDirectoryA RemoveDirectoryA CreateFileA GetFileAttributesA DeleteFileA FindFirstFileA FindNextFileA MoveFileA GetVolumeInformationA GetModuleFileNameA TerminateThread GetTickCount GlobalMemoryStatusEx GetProcessHandleCount OpenProcess GetCurrentProcess CreateThread CreateToolhelp32Snapshot Process32First Process32Next HeapAlloc HeapFree GetProcessHeap LocalSize GetVersionExA TerminateProcess QueryDosDeviceA GetCurrentThreadId lstrcmpiA SetUnhandledExceptionFilter SetErrorMode ReleaseMutex MapViewOfFile UnmapViewOfFile CreateMutexA OpenEventA CreateWaitableTimerA OpenFileMappingA UnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW LCMapStringW GetFileType GetStdHandle GetACP HeapReAlloc WideCharToMultiByte MultiByteToWideChar ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError InterlockedFlushSList RtlUnwind CreateFileW

user32

OpenInputDesktop CloseDesktop GetLastInputInfo CharNextA wsprintfA MessageBoxA OpenDesktopA GetThreadDesktop SetThreadDesktop GetProcessWindowStation SetProcessWindowStation OpenWindowStationA GetUserObjectInformationA GetWindowThreadProcessId EnumWindows GetWindowTextA IsWindowVisible

shell32

SHGetFileInfoA ShellExecuteA

psapi

GetModuleFileNameExA EnumProcessModules GetProcessImageFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

1d6237111040f49deca18906927ce72832cc021e87a748a25935b15189677318

advapi32

setupapi

kernel32

user32

shell32

psapi

generic