db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2

Sharing

Copy URL Twitter E-mail

General

Target
db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2
Size 5.1MB
Sample260530-mkfahaas21
SHA256 db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2
MD5 7b8222ac69cff6c91257a0fd3c4d2ef1
SHA1 ed66781cb634b25c560ee60c398be56182b96852
SHA512 99c5548f6df95587b868fc71f2ce242702a3d5d41476c429a7c31c98b45747490b5a054c9e2b0bdc8c826d8d29d352bc8d9d6e0407dd79ad44e24e3683e377cc
SSDEEP 98304:7MMMt6N5TVYZeSTwr1rcQZpDozMMMcL4CeHmfOmwvU0rWgsjenp9lq:e6N5TVYZeSTwr1rcQZpDoXL4dHmfOmw7
TLSH
T193368D2178418171EA6102B6DDBDFF6B48ACDA710B6855D3A3C83D5B3EB06D31B32297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2

File Explorer

db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2

.exe 5.1MB

db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2

IMPHASH a8f27399478eb31ee6bc1abe3f9b8c1a
SHA256 db730c316c04ad37a1aba290fc704d9d1e1663102ee507f19558f9f19c4d75d2
MD5 7b8222ac69cff6c91257a0fd3c4d2ef1
SHA1 ed66781cb634b25c560ee60c398be56182b96852
SHA512 99c5548f6df95587b868fc71f2ce242702a3d5d41476c429a7c31c98b45747490b5a054c9e2b0bdc8c826d8d29d352bc8d9d6e0407dd79ad44e24e3683e377cc
SSDEEP 98304:7MMMt6N5TVYZeSTwr1rcQZpDozMMMcL4CeHmfOmwvU0rWgsjenp9lq:e6N5TVYZeSTwr1rcQZpDoXL4dHmfOmw7
TLSH
T193368D2178418171EA6102B6DDBDFF6B48ACDA710B6855D3A3C83D5B3EB06D31B32297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3123675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveInClose waveInOpen waveInGetNumDevs waveOutReset waveOutWrite waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInPrepareHeader waveInReset waveInStop waveInStart waveInAddBuffer

ss3dgfunc

_Normalize@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16 _SetInverseMatrix@8 _WriteTGA@24 _COLORtoDWORD@16 _VECTOR3Length@4 BeginAnalyze EndAnalyze _CrossProduct@12 _SetRotationYMatrix@8

wsock32

connect htons select send setsockopt socket WSAStartup WSACleanup inet_addr gethostbyname closesocket bind getsockname WSAGetLastError sendto recvfrom ntohs ioctlsocket recv

dinput8

DirectInput8Create

ws2_32

inet_pton WSAIoctl

wininet

InternetConnectA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetReadFile InternetOpenUrlA InternetCloseHandle

kernel32

ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetVersionExW VirtualAlloc GetConsoleMode HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA OpenProcess TerminateProcess ReadFile CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte LCMapStringA GetSystemDefaultLangID InterlockedExchange InterlockedCompareExchange GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process GlobalAlloc GlobalLock GlobalUnlock GlobalFree lstrlenA SetCurrentDirectoryA VirtualFree Module32First Module32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime CompareFileTime lstrcmpiA InitializeSListHead ReadProcessMemory SetThreadPriority WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA GetModuleHandleW RemoveDirectoryA FindFirstFileA FindNextFileA CopyFileA MoveFileA Process32FirstW Process32NextW SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA GetTickCount64 QueryPerformanceCounter QueryPerformanceFrequency IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime GetStartupInfoW CreateEventW SetLastError UnhandledExceptionFilter GetCPInfo FatalAppExitA WriteConsoleW GetFileType GetStdHandle GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue VirtualProtect TlsAlloc GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx SetEvent RtlCaptureStackBackTrace QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue IsProcessorFeaturePresent RtlUnwind EncodePointer GetStringTypeW GetExitCodeThread GetSystemTimeAsFileTime SetProcessAffinityMask LoadLibraryW GetTimeZoneInformation FindFirstFileExW ExitProcess FindNextFileW UnregisterWaitEx FlushFileBuffers SetConsoleCtrlHandler GetFileAttributesExW CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WaitForMultipleObjectsEx SetEnvironmentVariableA SetEndOfFile LocalFree lstrlenW GetCurrentDirectoryA

user32

TranslateMessage wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindow GetWindowThreadProcessId GetTopWindow FindWindowExA EnumChildWindows GetWindowLongA CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient OffsetRect GetDC ReleaseDC EndDialog DispatchMessageA PeekMessageA DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow GetSystemMetrics UpdateWindow ShowCursor FindWindowW LoadIconA GetDesktopWindow MonitorFromWindow GetMonitorInfoW UnregisterClassA SetCursor GetWindowTextW IsWindowVisible IsWindow EnumDisplayDevicesW SendMessageA GetAsyncKeyState GetClientRect LoadCursorFromFileA

gdi32

DeleteObject GetTextExtentPoint32A SelectObject AddFontResourceExA RemoveFontResourceExA GetStockObject BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC CreateFontIndirectA

advapi32

OpenEventLogW RegQueryInfoKeyW RegQueryValueExW RegOpenKeyExA RegCloseKey AdjustTokenPrivileges OpenThreadToken OpenProcessToken RegQueryValueExA RegQueryInfoKeyA LookupPrivilegeValueA CloseEventLog GetNumberOfEventLogRecords RegOpenKeyExW GetUserNameW RegEnumKeyExW

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CreateStreamOnHGlobal

oleaut32

CreateErrorInfo VariantChangeType SetErrorInfo SysAllocString SysFreeString VariantClear VariantInit GetErrorInfo

freeimage

_FreeImage_Allocate@24 _FreeImage_Save@16 _FreeImage_GetScanLine@8 _FreeImage_SaveJPEG@12 _FreeImage_ConvertTo16Bits565@4 _FreeImage_GetInfo@4 _FreeImage_GetBits@4 _FreeImage_Load@12 _FreeImage_Unload@4

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetProcessImageFileNameA GetMappedFileNameW GetModuleInformation GetModuleFileNameExA EnumProcessModules

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptFinishHash BCryptHashData BCryptCreateHash

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSetOption

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=258, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=411, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=685, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,