tmp2tytrl_6

Sharing

Copy URL Twitter E-mail

General

Target
tmp2tytrl_6
Size 316KB
Sample260522-t8tw5acy21
SHA256 9218add9c9e265e5ff7a23d819c9c5e7f7dda6b0276e2b4a0abdacc87582aae9
MD5 e0180e8b6e43ec6bbd35b5e6a8b3627e
SHA1 184fee50dc9e686305378a5c393cdc83506627de
SHA512 6de6df4d17e9912172e69bef22b2f901b15e6689717ce2f35419c34b13efff12a8a92a3b1896cc904af6d615e88480a22b4e63ce8957ecc306fdda28e8e54da4
SSDEEP 6144:uP0AmFE3rXlFuwvmuayPEMPPx7AduK5JJcvHGiUHnXlY+8YVUA4fp7:s0BFQlFuwyMPJ7WBJJcv9ia+BVyJ
TLSH
T155640213B6ED688DD03EBD7446CF896FA1A7B17E05131D1BFA52174DA0FBAB01210E85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp2tytrl_6

File Explorer

tmp2tytrl_6

.exe 316KB

IMPHASH a64e49e186fc8d3ab7353e6a6e936694
SHA256 9218add9c9e265e5ff7a23d819c9c5e7f7dda6b0276e2b4a0abdacc87582aae9
MD5 e0180e8b6e43ec6bbd35b5e6a8b3627e
SHA1 184fee50dc9e686305378a5c393cdc83506627de
SHA512 6de6df4d17e9912172e69bef22b2f901b15e6689717ce2f35419c34b13efff12a8a92a3b1896cc904af6d615e88480a22b4e63ce8957ecc306fdda28e8e54da4
SSDEEP 6144:uP0AmFE3rXlFuwvmuayPEMPPx7AduK5JJcvHGiUHnXlY+8YVUA4fp7:s0BFQlFuwyMPJ7WBJJcv9ia+BVyJ
TLSH
T155640213B6ED688DD03EBD7446CF896FA1A7B17E05131D1BFA52174DA0FBAB01210E85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueA RegQueryInfoKeyW CryptCreateHash IsValidSecurityDescriptor RegSetValueExA RegQueryValueExA RegCreateKeyExW RegCreateKeyExA RegCloseKey GetTokenInformation RegOpenKeyExW InitializeAcl AddAccessAllowedAce CryptAcquireContextA RegEnumKeyExA RegQueryInfoKeyA GetSecurityDescriptorOwner InitializeSecurityDescriptor GetSidIdentifierAuthority PrivilegeCheck SetSecurityDescriptorOwner AllocateAndInitializeSid GetSidSubAuthorityCount RegDeleteKeyA SetSecurityDescriptorGroup LookupPrivilegeValueW CryptDestroyHash RegDeleteValueA SetSecurityDescriptorDacl RegConnectRegistryW GetUserNameW CryptHashData AccessCheck CryptGetHashParam OpenProcessToken GetLengthSid EqualSid ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateToken CryptReleaseContext RegQueryValueExW AdjustTokenPrivileges RegOpenKeyExA FreeSid GetSidSubAuthority GetKernelObjectSecurity

ole32

CoTaskMemAlloc CoTaskMemRealloc CoCreateGuid CoCreateInstance CoUninitialize StringFromCLSID CoWaitForMultipleHandles CoReleaseMarshalData CoCreateFreeThreadedMarshaler CoInitializeEx CoTaskMemFree StringFromGUID2

oleaut32

SysFreeString VariantChangeType VariantInit SysStringByteLen VarBstrCmp SysAllocStringByteLen SysReAllocStringLen VariantClear VariantCopy VarUI4FromStr SysAllocString SysAllocStringLen SysStringLen

user32

EnumWindows SetDebugErrorLevel PostThreadMessageW LoadStringA CharLowerBuffA IsWindowVisible GetWindowThreadProcessId LoadStringW CharNextA GetWindowTextW SetWindowLongW

shell32

CommandLineToArgvW

kernel32

GetThreadContext SetErrorMode LCMapStringW EnterCriticalSection GetThreadPriority Process32Next GetOverlappedResult VirtualAlloc LocalFree FormatMessageA VirtualFree FindFirstFileW ProcessIdToSessionId VirtualProtectEx IsDebuggerPresent TransactNamedPipe HeapDestroy RaiseException DuplicateHandle SizeofResource GetSystemDirectoryW DeleteFileW WaitForDebugEvent GetComputerNameW HeapAlloc Process32First CreateToolhelp32Snapshot ReleaseMutex ExpandEnvironmentStringsW FindResourceW GetModuleHandleA TlsSetValue LocalAlloc LeaveCriticalSection GetProcessAffinityMask DeleteCriticalSection LoadResource GetModuleHandleW ResetEvent SuspendThread SetUnhandledExceptionFilter SwitchToThread FindResourceA TlsAlloc WriteProcessMemory GetThreadSelectorEntry HeapSize GetProcessHeap ReadFile FreeLibraryAndExitThread CreateEventW CreateEventA GetCurrentThreadId GetVolumeInformationW GetFileInformationByHandle UnmapViewOfFile lstrcmpiA CancelIo DebugActiveProcess CreateFileMappingW GetSystemTimeAsFileTime TlsGetValue WaitNamedPipeW TlsFree FindResourceExW GetFullPathNameW MapViewOfFile CreateProcessW FreeEnvironmentStringsW GetLongPathNameW lstrlenW CreateMutexW FlushInstructionCache SetThreadAffinityMask ReadProcessMemory VirtualQueryEx FreeLibrary OutputDebugStringW CreateFileW GetSystemInfo CreateRemoteThread GetCurrentDirectoryW WaitForSingleObject InitializeCriticalSectionAndSpinCount LoadLibraryExA LockResource SetNamedPipeHandleState SetThreadContext GetFileSize UnhandledExceptionFilter FormatMessageW QueryPerformanceFrequency VirtualQuery GetLogicalDrives CreateThread QueryDosDeviceW SearchPathW OpenProcess GetWindowsDirectoryW LoadLibraryExW WideCharToMultiByte SetFilePointer CloseHandle HeapReAlloc SetLastError lstrlenA ResumeThread GetFileTime IsDBCSLeadByte FindClose OpenThread CreateFileMappingA SetHandleInformation HeapFree ContinueDebugEvent IsValidCodePage VirtualAllocEx

comctl32

CreateStatusWindow ImageList_Write InitCommonControlsEx FlatSB_SetScrollInfo ImageList_LoadImageA ImageList_EndDrag ImageList_Read CreatePropertySheetPage ImageList_SetBkColor

kbddv

KbdLayerDescriptor

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

27KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

185KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

58KB

Virtual Size

389KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp2tytrl_6

advapi32

ole32

oleaut32

user32

shell32

kernel32

comctl32

kbddv

generic