7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df

Sharing

Copy URL Twitter E-mail

General

Target
7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df
Size 394KB
Sample260528-v8pg3sht2p
SHA256 7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df
MD5 1748abbc5e0ce7abb18a42e8a3fcc5a4
SHA1 c6abdf66f5528f80c1025ca2689a9b8700f6954a
SHA512 f3a9eecfa5e82599453417bc63b11a2938fdf1648aacf8df08f45467af199e7f4be2adab1bf0e37dd4c1486ed20d9dcb54bf2423aa47eed1546ab2b795f2a1db
SSDEEP 6144:A0WgIH9RkcsYAnKNFDIU9pXEi34Qb1W7xniR4urE8UsEcsFK9u00:A0cQcsYtDIU9OQB99UFK9u
TLSH
T104849EA5F6A404F9E07B9238C9A14636D2F2782A07609BCF03F406955F23FE5A53FB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df

File Explorer

7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df

.dll 394KB

7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df

IMPHASH 05648141e05a4b2f620552bcf8e57650
SHA256 7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df
MD5 1748abbc5e0ce7abb18a42e8a3fcc5a4
SHA1 c6abdf66f5528f80c1025ca2689a9b8700f6954a
SHA512 f3a9eecfa5e82599453417bc63b11a2938fdf1648aacf8df08f45467af199e7f4be2adab1bf0e37dd4c1486ed20d9dcb54bf2423aa47eed1546ab2b795f2a1db
SSDEEP 6144:A0WgIH9RkcsYAnKNFDIU9pXEi34Qb1W7xniR4urE8UsEcsFK9u00:A0cQcsYtDIU9OQB99UFK9u
TLSH
T104849EA5F6A404F9E07B9238C9A14636D2F2782A07609BCF03F406955F23FE5A53FB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\hrcode\hr_sysdiag-fund\bin\x64\uactmon.pdb

shlwapi

wnsprintfW

libxsse

ord11 ord10

iphlpapi

SetTcpEntry

ws2_32

htons

kernel32

GetVersion MultiByteToWideChar Sleep GetLastError GetSystemInfo GetCurrentDirectoryW SearchPathA GetWindowsDirectoryW SetFilePointerEx LocalFree DeleteCriticalSection WideCharToMultiByte IsBadReadPtr CreateFileMappingW MapViewOfFile GetTickCount SetThreadPriority WaitForSingleObject SetEvent GetCurrentThread GetVersionExA CreateThread CreateEventA DuplicateHandle ReleaseSemaphore WaitForMultipleObjects GetThreadPriority CreateSemaphoreA DeviceIoControl GetOverlappedResult GetLongPathNameA TerminateThread WaitForSingleObjectEx LoadLibraryW ResetEvent OpenProcess GetTimeZoneInformation HeapSize GetStringTypeW SetStdHandle GetFullPathNameA GetFullPathNameW SetCurrentDirectoryW SetConsoleCtrlHandler GetStdHandle GetProcessHeap SetEnvironmentVariableW SetEnvironmentVariableA UnmapViewOfFile GetFileAttributesW CreateFileW SetEndOfFile ExpandEnvironmentStringsA InitializeCriticalSection LeaveCriticalSection WriteFile GetCurrentProcess GetLongPathNameW EnterCriticalSection VirtualProtect GetFileSizeEx GetModuleFileNameA ReadFile RaiseException CreateIoCompletionPort GetProcAddress CloseHandle LoadLibraryA PostQueuedCompletionStatus GetQueuedCompletionStatus FlushFileBuffers GetConsoleCP GetModuleHandleA GetConsoleMode OutputDebugStringA OutputDebugStringW WriteConsoleW DisableThreadLibraryCalls RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileAttributesExW SetFileAttributesW DeleteFileW ExitProcess GetModuleHandleExW GetModuleFileNameW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime HeapFree HeapAlloc HeapReAlloc GetACP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW

user32

EnumWindowStationsA GetWindowRect IsWindowVisible CloseWindowStation GetWindowThreadProcessId CloseDesktop OpenWindowStationA OpenDesktopA EnumDesktopWindows GetParent EnumDesktopsA

advapi32

RegSetKeySecurity CloseServiceHandle OpenSCManagerW OpenServiceW BuildExplicitAccessWithNameA SetSecurityDescriptorDacl SetEntriesInAclA GetSecurityDescriptorDacl RegGetKeySecurity RegCloseKey RegDeleteKeyA RegQueryValueExA RegDeleteKeyW RegCreateKeyExA RegEnumKeyExW RegSetValueExW RegSetValueExA OpenProcessToken RegLoadKeyA InitializeSecurityDescriptor RegOpenKeyExA RegOpenKeyExW ConvertSidToStringSidW RegEnumValueA RegDeleteValueA RegOpenKeyW RegSaveKeyA RegQueryValueExW RegEnumKeyExA GetTokenInformation

Name

.text

Size

294KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7253db160ec9f73d881fd9ca326c6713da60bfd9ce3cf63b9f61f25ad389c6df

shlwapi

libxsse

iphlpapi

ws2_32

kernel32

user32

advapi32

generic