e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e

Sharing

Copy URL Twitter E-mail

General

Target
e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e
Size 277KB
Sample260508-k3fb4se16w
SHA256 e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e
MD5 d5ff61dfeca7c2e679644b747bb1f72a
SHA1 b3c886bd8641ebb4bfe16abe25624fdde4ed832b
SHA512 f007ad050f341a4e1418ec9cf56cefc1dee57a0926ea7aafcac7da4a680fdb1ad606b9ae53b67884bf5dd42fcf65d10f8e6e7349ab017832f74a6f9e38db35c5
SSDEEP 6144:Va+K9nWZWWrfy9j78LGRNHGYZfIT2HtsxF5l:U+K9nofG8LGnvJITRl
TLSH
T1ED544B00B7C19435F87B0D365ABA855A496CBD711F14EDDBE3C4091B0ABA5E2EA30E37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e

File Explorer

e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e

.dll 277KB

e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e

IMPHASH 5cf255c7e758dc0ecb1cbf012519777d
SHA256 e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e
MD5 d5ff61dfeca7c2e679644b747bb1f72a
SHA1 b3c886bd8641ebb4bfe16abe25624fdde4ed832b
SHA512 f007ad050f341a4e1418ec9cf56cefc1dee57a0926ea7aafcac7da4a680fdb1ad606b9ae53b67884bf5dd42fcf65d10f8e6e7349ab017832f74a6f9e38db35c5
SSDEEP 6144:Va+K9nWZWWrfy9j78LGRNHGYZfIT2HtsxF5l:U+K9nofG8LGnvJITRl
TLSH
T1ED544B00B7C19435F87B0D365ABA855A496CBD711F14EDDBE3C4091B0ABA5E2EA30E37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101411

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\work\DSE-V6-6.8.6-R2\Enterprise\bin\MgrDll.pdb

gdi32

CreateDIBSection SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

UnlockServiceDatabase StartServiceA QueryServiceStatus SetServiceStatus RegisterServiceCtrlHandlerA DuplicateTokenEx SetTokenInformation RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegSetValueExA RegQueryInfoKeyA QueryServiceConfig2A ChangeServiceConfigA CloseServiceHandle ControlService DeleteService EnumServicesStatusA LockServiceDatabase OpenSCManagerA OpenServiceA QueryServiceConfigA

avicap32

capGetDriverDescriptionA capCreateCaptureWindowA

msvfw32

ICSeqCompressFrame ICCompressorFree ICClose ICSeqCompressFrameEnd ICSeqCompressFrameStart ICSendMessage ICOpen

ws2_32

gethostname

setupapi

SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDescriptionA SetupDiSetClassInstallParamsA SetupDiGetClassImageList SetupDiGetClassImageIndex SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstallParamsA SetupDiGetDeviceInstanceIdA SetupDiDestroyClassImageList CM_Get_DevNode_Status SetupDiEnumDeviceInfo

kernel32

GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle GetStringTypeW WriteConsoleW SetFilePointerEx HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExA InterlockedExchange SetEvent WaitForSingleObject Sleep CloseHandle lstrcpyA GetProcAddress ResetEvent CreateEventA GetModuleHandleA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemTimes DecodePointer LocalAlloc LocalFree RaiseException GetLastError InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA OutputDebugStringA LocalReAlloc GetFileSize WriteFile ReadFile SetFilePointer FindClose lstrlenA GetDriveTypeA GetDiskFreeSpaceExA CreateDirectoryA RemoveDirectoryA CreateFileA GetFileAttributesA DeleteFileA FindFirstFileA FindNextFileA MoveFileA GetVolumeInformationA GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetVersionExA TerminateThread GetTickCount GetProcessHandleCount OpenProcess GetCurrentProcess CreateThread CreateToolhelp32Snapshot Process32First Process32Next HeapAlloc HeapFree GetProcessHeap lstrcatA LocalSize GlobalAlloc GlobalSize GlobalLock GlobalUnlock GlobalFree VirtualAlloc VirtualFree TerminateProcess QueryDosDeviceA GetWindowsDirectoryA GetCurrentThreadId lstrcmpiA SetUnhandledExceptionFilter SetErrorMode ReleaseMutex MapViewOfFile UnmapViewOfFile CreateMutexA OpenEventA CreateWaitableTimerA OpenFileMappingA GetModuleFileNameA FreeConsole UnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW LCMapStringW GetFileType GetStdHandle GetACP HeapReAlloc MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError InterlockedFlushSList RtlUnwind CreateFileW

user32

GetCursorPos ReleaseDC GetDC BlockInput SystemParametersInfoA DestroyCursor OpenDesktopA WindowFromPoint SetCursorPos SetThreadDesktop SetCapture MapVirtualKeyA mouse_event GetDesktopWindow EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SendMessageA GetLastInputInfo CharNextA wsprintfA MessageBoxA GetWindowThreadProcessId GetCursorInfo CloseDesktop GetThreadDesktop SetRect keybd_event OpenInputDesktop GetUserObjectInformationA GetProcessWindowStation SetProcessWindowStation OpenWindowStationA CloseWindow IsWindow GetSystemMetrics CreateWindowExA EnumWindows GetWindowTextA LoadCursorA IsWindowVisible

shell32

ShellExecuteA SHGetFileInfoA

psapi

GetModuleFileNameExA EnumProcessModules GetProcessImageFileNameA

wtsapi32

WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

e36f0dd3edfd881923ab1a7654d129f5b0b47ece1d07465084b01df0c724829e

gdi32

advapi32

avicap32

msvfw32

ws2_32

setupapi

kernel32

user32

shell32

psapi

wtsapi32

generic