tmpfqdcfxj6

Sharing

Copy URL Twitter E-mail

General

Target
tmpfqdcfxj6
Size 4.2MB
Sample260522-y5s8msgw9x
SHA256 04e398c95d50638aaa182894dc0209a340421a017cebb8503b024c30b46fba8b
MD5 e4c4654f3afc6fae6928d956d1a2d7eb
SHA1 2511ac6d76145398f8a3cfdccff9942fe1080d96
SHA512 8b58052b02ff4e2522fb18a5190b6bb2c8230d3da2af0c21b18f93ee94520732f0c1ae754cd59ebdc7b092d08137eeb330e8d36e85b91afef10b3c6d858deeca
SSDEEP 49152:/3UZmvUizUEZMygl+/F3w6E18HzCB4AlgJ+BFIcBYMZfnxYynakWJ0S/3:nuyglOxGusnxYyna/v
TLSH
T11A169E1AB2B901F8C0A7C5798A178D13EA72745903729BEF17E089652F23AF05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpfqdcfxj6

File Explorer

tmpfqdcfxj6

.exe 4.2MB

IMPHASH 92ed7ee1e390907649c4946fb9d65a25
SHA256 04e398c95d50638aaa182894dc0209a340421a017cebb8503b024c30b46fba8b
MD5 e4c4654f3afc6fae6928d956d1a2d7eb
SHA1 2511ac6d76145398f8a3cfdccff9942fe1080d96
SHA512 8b58052b02ff4e2522fb18a5190b6bb2c8230d3da2af0c21b18f93ee94520732f0c1ae754cd59ebdc7b092d08137eeb330e8d36e85b91afef10b3c6d858deeca
SSDEEP 49152:/3UZmvUizUEZMygl+/F3w6E18HzCB4AlgJ+BFIcBYMZfnxYynakWJ0S/3:nuyglOxGusnxYyna/v
TLSH
T11A169E1AB2B901F8C0A7C5798A178D13EA72745903729BEF17E089652F23AF05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1878440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpConnect WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpCrackUrl WinHttpWebSocketClose WinHttpWebSocketSend WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpSendRequest WinHttpQueryDataAvailable WinHttpWebSocketReceive

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptCreateHash BCryptSetProperty BCryptOpenAlgorithmProvider BCryptEncrypt BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptFinishHash BCryptDestroyHash BCryptHashData

wtsapi32

WTSQueryUserToken

shell32

ShellExecuteExW CommandLineToArgvW ShellExecuteA ShellExecuteW

shlwapi

PathFileExistsW PathFindFileNameW

ole32

CreateStreamOnHGlobal CoTaskMemFree

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ntdll

RtlInitUnicodeString RtlUnwind RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

gdiplus

GdipSetPixelOffsetMode GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipSetInterpolationMode GdipSetCompositingQuality GdipDrawImageRectI

kernel32

CompareStringW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError LCMapStringW GetLocaleInfoW GetLastError ExitProcess MultiByteToWideChar SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource GetModuleFileNameW EnumResourceNamesW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetDriveTypeW LoadLibraryExW ReadFile GetFileSizeEx WriteProcessMemory FindFirstFileA GetCurrentProcess WriteFile WaitForDebugEvent K32GetModuleFileNameExW FindNextFileA SetFilePointer GetFullPathNameA FindClose IsValidLocale DebugActiveProcessStop SuspendThread ResumeThread ContinueDebugEvent DuplicateHandle K32EnumProcessModulesEx GetFinalPathNameByHandleA GetTickCount64 GetFileAttributesA CreateFileA VirtualProtectEx GetThreadContext GetProcAddress WTSGetActiveConsoleSessionId ReadProcessMemory GetCurrentProcessId CreateProcessW GetFileType K32GetMappedFileNameW SetThreadContext OpenThread VirtualQueryEx DebugSetProcessKillOnExit GetVolumeInformationW FindFirstFileW FindNextFileW CreateFileW DeleteFileW MoveFileExW GetComputerNameW GlobalMemoryStatusEx GlobalAlloc GlobalLock GlobalUnlock GetFileAttributesExW GetTickCount GetCurrentThreadId GetTempPathW GetSystemTime GetCommandLineW CreateMutexW GetVersionExW ExitThread GetFileSize SetUnhandledExceptionFilter GetTimeZoneInformation GetSystemInfo CreateDirectoryW QueryDosDeviceW GetFileAttributesExA ExpandEnvironmentStringsA GetEnvironmentVariableW CreateThread GetLocalTime CopyFileW GetFileAttributesW LoadLibraryW SetDllDirectoryW GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode FileTimeToSystemTime SetFilePointerEx CreateProcessA GetDiskFreeSpaceExA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate HeapSize GetUserDefaultLCID FormatMessageW GetDiskFreeSpaceA OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW WaitForSingleObject GetTempPathA

user32

SendInput OpenClipboard CloseClipboard GetMonitorInfoW GetSystemMetrics EnumDisplayMonitors EmptyClipboard GetClipboardData ReleaseDC QueryDisplayConfig GetDC CharUpperA EnumDisplayDevicesW SetClipboardData

gdi32

SelectObject CreateCompatibleBitmap DeleteObject BitBlt DeleteDC CreateCompatibleDC GetDeviceCaps

advapi32

OpenProcessToken RegEnumKeyExW RegOpenKeyExW RegDeleteTreeA EqualSid AllocateAndInitializeSid RegCreateKeyExA CreateProcessWithTokenW RegSetValueExA FreeSid CryptAcquireContextA RevertToSelf SetTokenInformation ImpersonateLoggedOnUser RegSetValueExW RegOpenKeyExA DuplicateTokenEx RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW CreateProcessAsUserW LookupPrivilegeValueA RegQueryValueExW RegGetValueW GetUserNameW RegEnumKeyExA GetTokenInformation RegQueryValueExA CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptAcquireContextW

setupapi

SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx ReleaseSRWLockExclusive TryAcquireSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-0

GetExitCodeThread GetStartupInfoW

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle GetFinalPathNameByHandleW FindFirstFileExW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx GetCPInfo LCMapStringEx

api-ms-win-core-synch-l1-2-0

WakeConditionVariable SleepConditionVariableSRW WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtNext EvtRender EvtClose EvtCreateRenderContext EvtQuery

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mf

MFEnumDeviceSources

mfplat

MFShutdown MFCreateMediaType MFCreateAttributes MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpfqdcfxj6

winhttp

crypt32

bcrypt

wtsapi32

shell32

shlwapi

ole32

userenv

ntdll

gdiplus

kernel32

user32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

d3d11

dxgi

mf

mfplat

mfreadwrite

generic