288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96

Sharing

Copy URL Twitter E-mail

General

Target
288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96
Size 243KB
Sample260508-feptesc12v
SHA256 288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96
MD5 bb0f1fcedb2890de7fd644d8f06706d6
SHA1 32aef501d1901d9a0d5b98229b6308a7de7b82d4
SHA512 838ad75edcffea4ffff8e0e5bd8b42dd3da980eee54adfdaaa4251294b29f9989ed3998572e858131045e8e73a3c5543ac8f34123d6a327a30b3233e14781904
SSDEEP 3072:D7E/duTr6k6w/fI7gMKjXV5HTM1Ulbi5q9WfmBZwrWVffeKqv/F1Av8w65ckOdSl:/rBxIhKhBTM1Gi5HfNKmVfAt+Ot/xC
TLSH
T1C9343A0072C1D435F8BB1D364AB9865A4A6CBD701B15ECDBE3C4191A1F796E2EA30E73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96

File Explorer

288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96

.dll 243KB

288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96

IMPHASH 8cf2b291fd94dea10223514ba155d51a
SHA256 288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96
MD5 bb0f1fcedb2890de7fd644d8f06706d6
SHA1 32aef501d1901d9a0d5b98229b6308a7de7b82d4
SHA512 838ad75edcffea4ffff8e0e5bd8b42dd3da980eee54adfdaaa4251294b29f9989ed3998572e858131045e8e73a3c5543ac8f34123d6a327a30b3233e14781904
SSDEEP 3072:D7E/duTr6k6w/fI7gMKjXV5HTM1Ulbi5q9WfmBZwrWVffeKqv/F1Av8w65ckOdSl:/rBxIhKhBTM1Gi5HfNKmVfAt+Ot/xC
TLSH
T1C9343A0072C1D435F8BB1D364AB9865A4A6CBD701B15ECDBE3C4191A1F796E2EA30E73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\work\DSE-V6-6.8.6-R2\Enterprise\bin\MgrDll.pdb

advapi32

ChangeServiceConfigA QueryServiceStatus QueryServiceConfig2A QueryServiceConfigA UnlockServiceDatabase RegCloseKey RegOpenKeyExA RegQueryValueExA OpenServiceA CloseServiceHandle ControlService DeleteService EnumServicesStatusA LockServiceDatabase OpenSCManagerA StartServiceA

setupapi

SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDescriptionA SetupDiSetClassInstallParamsA SetupDiGetClassImageList SetupDiGetClassImageIndex SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstallParamsA SetupDiDestroyClassImageList CM_Get_DevNode_Status SetupDiGetDeviceInstanceIdA

kernel32

WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle GetStringTypeW HeapSize SetFilePointerEx FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExA InterlockedExchange SetEvent WaitForSingleObject Sleep CloseHandle lstrcpyA GetProcAddress ResetEvent CreateEventA LoadLibraryA GetSystemDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemTimes DecodePointer LocalAlloc LocalFree RaiseException GetLastError InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA GetModuleHandleA OutputDebugStringA LocalReAlloc GetFileSize WriteFile ReadFile SetFilePointer FindClose lstrlenA GetDriveTypeA GetDiskFreeSpaceExA CreateDirectoryA RemoveDirectoryA CreateFileA GetFileAttributesA DeleteFileA FindFirstFileA FindNextFileA MoveFileA GetVolumeInformationA GetModuleFileNameA TerminateThread GetTickCount GlobalMemoryStatusEx GetProcessHandleCount OpenProcess GetCurrentProcess CreateThread CreateToolhelp32Snapshot Process32First Process32Next HeapAlloc HeapFree GetProcessHeap LocalSize GetVersionExA TerminateProcess QueryDosDeviceA GetCurrentThreadId lstrcmpiA SetUnhandledExceptionFilter SetErrorMode ReleaseMutex MapViewOfFile UnmapViewOfFile CreateMutexA OpenEventA CreateWaitableTimerA OpenFileMappingA UnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW LCMapStringW GetFileType GetStdHandle GetACP HeapReAlloc WideCharToMultiByte MultiByteToWideChar ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError InterlockedFlushSList RtlUnwind CreateFileW

user32

OpenInputDesktop CloseDesktop GetLastInputInfo CharNextA wsprintfA MessageBoxA OpenDesktopA GetThreadDesktop SetThreadDesktop GetProcessWindowStation SetProcessWindowStation OpenWindowStationA GetUserObjectInformationA GetWindowThreadProcessId EnumWindows GetWindowTextA IsWindowVisible

shell32

SHGetFileInfoA ShellExecuteA

psapi

GetModuleFileNameExA EnumProcessModules GetProcessImageFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

288991761bd03d9f9fb025123f36f639ade967b50fdd1300d0bf423393c3bd96

advapi32

setupapi

kernel32

user32

shell32

psapi

generic