a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3

Sharing

Copy URL Twitter E-mail

General

Target
a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3
Size 3.5MB
Sample260527-m2ltlses2v
SHA256 a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3
MD5 64d888002d7b2495038ef9db00dfbe54
SHA1 f77a1b8b66f26a79b490770a7dd2423a5479b99e
SHA512 3aa7a7aa12d323b65e2a6a1d9755127fee361870362107bc8f39c4cf2fc4279f5bae85788ba215104050ca1a0e82162fab3e4255880f9f5e3b21622f9159c0ad
SSDEEP 49152:T44B+lNsHPWeelGdwSxQRw9CuL0wijepAVJsm7ZUCCw8WzpMU333Oz:sIPp70wijepGCm7hCOuU333w
TLSH
T16F066C13F389653ED06B1A3B683F9254583F766039138C579BEC3A4C8E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3

File Explorer

a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3

.exe 3.5MB

a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3

IMPHASH adcd9682585d11d95f17bb6ffa76f15e
SHA256 a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3
MD5 64d888002d7b2495038ef9db00dfbe54
SHA1 f77a1b8b66f26a79b490770a7dd2423a5479b99e
SHA512 3aa7a7aa12d323b65e2a6a1d9755127fee361870362107bc8f39c4cf2fc4279f5bae85788ba215104050ca1a0e82162fab3e4255880f9f5e3b21622f9159c0ad
SSDEEP 49152:T44B+lNsHPWeelGdwSxQRw9CuL0wijepAVJsm7ZUCCw8WzpMU333Oz:sIPp70wijepGCm7hCOuU333w
TLSH
T16F066C13F389653ED06B1A3B683F9254583F766039138C579BEC3A4C8E795802E3A767
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3182264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mpr

WNetEnumResourceW WNetGetUniversalNameW WNetGetConnectionW WNetCloseEnum WNetOpenEnumW

comdlg32

GetSaveFileNameW GetOpenFileNameW

comctl32

FlatSB_SetScrollInfo InitCommonControls ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_Draw ImageList_Remove ImageList_SetOverlayImage

shell32

SHBrowseForFolderW SHGetMalloc SHGetFileInfoW SHChangeNotify Shell_NotifyIconW SHAppBarMessage ShellExecuteW SHGetPathFromIDListW ShellExecuteExW

user32

MoveWindow CopyImage SetMenuItemInfoW GetMenuItemInfoW DefFrameProcW ScrollWindowEx GetDlgCtrlID FrameRect RegisterWindowMessageW GetMenuStringW FillRect SendMessageA EnumWindows ShowOwnedPopups GetClassInfoW GetScrollRange SetActiveWindow GetActiveWindow DrawEdge GetKeyboardLayoutList OemToCharBuffA LoadBitmapW EnumChildWindows SendNotifyMessageW GetScrollBarInfo UnhookWindowsHookEx SetCapture GetCapture ShowCaret CreatePopupMenu GetMenuItemID CharLowerBuffW PostMessageW SetWindowLongW IsZoomed SetParent DrawMenuBar GetClientRect IsChild IsIconic CallNextHookEx ShowWindow GetWindowTextW SetForegroundWindow IsDialogMessageW DestroyWindow RegisterClassW EndMenu CharNextW GetFocus GetDC SetFocus ReleaseDC ExitWindowsEx GetClassLongW SetScrollRange DrawTextW CharToOemBuffA PeekMessageA MessageBeep SetClassLongW SetRectEmpty RemovePropW GetSubMenu DestroyIcon IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW SendMessageTimeoutW LoadStringW CreateMenu CharLowerW SetWindowRgn SetWindowPos GetMenuItemCount GetSysColorBrush GetWindowDC DrawTextExW ReplyMessage GetScrollInfo SetWindowTextW GetMessageExtraInfo GetSysColor EnableScrollBar TrackPopupMenu DrawIconEx GetClassNameW GetMessagePos GetIconInfo SetScrollInfo GetKeyNameTextW GetDesktopWindow SetCursorPos GetCursorPos SetMenu GetMenuState GetMenu SetRect GetKeyState ValidateRect GetCursor KillTimer WaitMessage TranslateMDISysAccel GetWindowPlacement CreateIconIndirect CreateWindowExW GetMessageW GetDCEx PeekMessageW MonitorFromWindow GetUpdateRect SetTimer WindowFromPoint BeginPaint RegisterClipboardFormatW MapVirtualKeyW OffsetRect IsWindowUnicode DispatchMessageW DefMDIChildProcW WaitForInputIdle GetSystemMenu SetScrollPos GetScrollPos InflateRect DrawFocusRect ReleaseCapture LoadCursorW ScrollWindow GetLastActivePopup GetSystemMetrics CharUpperBuffW GetClipboardData ClientToScreen SetWindowPlacement GetMonitorInfoW CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow EnableWindow GetWindowThreadProcessId RedrawWindow EndPaint MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW ActivateKeyboardLayout GetParent InsertMenuItemW GetPropW MessageBoxW SetPropW UpdateWindow MsgWaitForMultipleObjects DestroyMenu SetWindowsHookExW AdjustWindowRectEx IsWindow DrawIcon EnumThreadWindows InvalidateRect GetKeyboardState ScreenToClient DrawFrameControl SetCursor CreateIcon RemoveMenu AppendMenuW GetKeyboardLayoutNameW TranslateMessage MapWindowPoints EnumDisplayMonitors CallWindowProcW DestroyCursor PostQuitMessage ShowScrollBar LoadImageW EnableMenuItem HideCaret FindWindowExW MonitorFromPoint LoadIconW SystemParametersInfoW GetWindow GetWindowRect GetWindowLongW InsertMenuW IsWindowEnabled IsDialogMessageA FindWindowW GetKeyboardLayout DeleteMenu

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement LoadTypeLib GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement GetActiveObject SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound RegisterTypeLib VariantCopyInd VariantChangeType

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

advapi32

RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenThreadToken GetUserNameW RegQueryInfoKeyW EqualSid GetTokenInformation RegCreateKeyExW SetSecurityDescriptorDacl RegEnumKeyExW AdjustTokenPrivileges RegDeleteKeyW LookupPrivilegeValueW RegOpenKeyExW OpenProcessToken FreeSid AllocateAndInitializeSid RegDeleteValueW RegFlushKey RegEnumValueW RegQueryValueExW ConvertSidToStringSidW RegCloseKey InitializeSecurityDescriptor

msvcrt

memcpy memset

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpSetTimeouts WinHttpSetStatusCallback WinHttpConnect WinHttpReceiveResponse WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpReadData WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpWriteData WinHttpSetCredentials WinHttpQueryDataAvailable WinHttpSetOption WinHttpSendRequest WinHttpQueryOption

kernel32

SetFileAttributesW SetFileTime GetACP GetExitCodeProcess CloseHandle LocalFree GetCurrentProcessId SizeofResource VirtualProtect TerminateThread QueryPerformanceFrequency SetHandleInformation IsDebuggerPresent FindNextFileW GetFullPathNameW VirtualFree GetProcessHeap ExitProcess HeapAlloc WriteProfileStringW GetCPInfoExW GetLongPathNameW RtlUnwind SetFilePointerEx GetCPInfo GetStdHandle GetTimeZoneInformation FileTimeToLocalFileTime GetModuleHandleW FreeLibrary HeapDestroy CompareFileTime ReadFile CreateProcessW TransactNamedPipe GetLastError GetModuleFileNameW SetLastError FindResourceW OpenMutexW CreateThread CompareStringW CopyFileW GetFileSizeEx CreateMutexW LoadLibraryA GetVolumeInformationW ResetEvent MulDiv FreeResource GetDriveTypeW GetVersion RaiseException MoveFileW GlobalAddAtomW GetSystemTimeAsFileTime FormatMessageW OpenProcess SwitchToThread GetExitCodeThread GetCurrentThread GetLogicalDrives LocalFileTimeToFileTime SetNamedPipeHandleState LoadLibraryExW TerminateProcess LockResource FileTimeToSystemTime GetShortPathNameW GetCurrentThreadId UnhandledExceptionFilter MoveFileExW PeekNamedPipe GlobalFindAtomW VirtualQuery GlobalFree VirtualQueryEx Sleep EnterCriticalSection SetFilePointer ReleaseMutex FlushFileBuffers LoadResource SuspendThread GetTickCount WritePrivateProfileStringW GetTempFileNameW GlobalDeleteAtom GetStartupInfoW GetFileAttributesW GetCurrentDirectoryW SetCurrentDirectoryW InitializeCriticalSection GetSystemWindowsDirectoryW GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc GetTempPathW GetCommandLineW GetSystemInfo DuplicateHandle LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate GetWindowsDirectoryW DeviceIoControl LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile lstrcmpW HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW GetSystemDirectoryW DeleteFileW FormatMessageA GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile CreateNamedPipeW ExitThread CreatePipe DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue CreateDirectoryW GetOverlappedResult GetSystemDefaultUILanguage EnumCalendarInfoW GetProfileStringW LocalAlloc GetUserDefaultLangID RemoveDirectoryW CreateEventW GetPrivateProfileStringW WaitForMultipleObjectsEx GetThreadLocale SetThreadLocale

ole32

StgCreateDocfileOnILockBytes CoCreateInstance CLSIDFromString CoUninitialize IsEqualGUID OleInitialize CoFreeUnusedLibraries CreateILockBytesOnHGlobal CLSIDFromProgID CoInitializeEx OleUninitialize CoDisconnectObject CoInitialize CoTaskMemFree CoTaskMemAlloc StringFromCLSID

gdi32

Arc Pie SetBkMode SelectPalette CreateCompatibleBitmap GetEnhMetaFileHeader ExcludeClipRect SetWindowOrgEx RectVisible MaskBlt AngleArc DeleteEnhMetaFile ResizePalette Chord SetTextColor SetDIBits StretchBlt SetViewportOrgEx CreateRectRgn RealizePalette GetDIBColorTable SetDIBColorTable RoundRect RestoreDC SetRectRgn GetTextMetricsW RemoveFontResourceW GetWindowOrgEx CreatePalette CreateBrushIndirect PatBlt LineDDA SetEnhMetaFileBits PolyBezierTo GetStockObject CreateSolidBrush Polygon Rectangle MoveToEx DeleteDC SaveDC PlayEnhMetaFile BitBlt Ellipse FrameRgn GetDeviceCaps GetBitmapBits GetTextExtentPoint32W GetClipBox Polyline IntersectClipRect GetEnhMetaFileBits GetSystemPaletteEntries CreateBitmap AddFontResourceW CombineRgn SetWinMetaFileBits CreateDIBitmap GetStretchBltMode CreateDIBSection CreatePenIndirect GetDIBits GetEnhMetaFilePaletteEntries SetStretchBltMode CreateFontIndirectW PolyBezier LineTo GetRgnBox EnumFontsW CreateHalftonePalette DeleteObject SelectObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetObjectW GetBrushOrgEx GetCurrentPositionEx GetWinMetaFileBits SetROP2 GetNearestPaletteIndex GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetEnhMetaFileDescriptionW GetPixel ArcTo GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

ntdll

_allshl _aullshr

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

44KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

110B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

88B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a4f323ac96454dc9937c1cbe2ed715ad771f5582fe36fbe47cee98e9b47783f3

mpr

comdlg32

comctl32

shell32

user32

version

oleaut32

wtsapi32

advapi32

msvcrt

winhttp

kernel32

ole32

gdi32

ntdll

generic