2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1

Sharing

Copy URL Twitter E-mail

General

Target
2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1
Size 4.7MB
Sample260531-vfpmdaft5p
SHA256 2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1
MD5 0913c2c4327ec15d919ff208c36aa95b
SHA1 6d73eabb4f18da4c8b5a24bda8fddb9d12947e63
SHA512 bcbf743576359c6a2b02764e8a3014e5e44bd0693d63338ac2d9fd9d1c1ab6582de5a5ec9f445dd01ddb3c55066b46bb5cd7ca20000b76d4cb51192ae43b954c
SSDEEP 98304:Wg4iRXV+73K786UP46FWbC97xhGaiK5AJY7VtIjBZZcLFhgaG7AN:TXVx786UPxFh97rl95gY7kXZcLxN
TLSH
T1E1363381AF85BC71C03100312A6AE67E6EFF7D204E5686CB5BD3BEDD9A304829D35761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1

File Explorer

2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1

.exe 4.7MB

2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1

IMPHASH 366665a8afe76046e7aff35b7aaab5de
SHA256 2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1
MD5 0913c2c4327ec15d919ff208c36aa95b
SHA1 6d73eabb4f18da4c8b5a24bda8fddb9d12947e63
SHA512 bcbf743576359c6a2b02764e8a3014e5e44bd0693d63338ac2d9fd9d1c1ab6582de5a5ec9f445dd01ddb3c55066b46bb5cd7ca20000b76d4cb51192ae43b954c
SSDEEP 98304:Wg4iRXV+73K786UP46FWbC97xhGaiK5AJY7VtIjBZZcLFhgaG7AN:TXVx786UPxFh97rl95gY7kXZcLxN
TLSH
T1E1363381AF85BC71C03100312A6AE67E6EFF7D204E5686CB5BD3BEDD9A304829D35761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

139979

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\devel\ark7\bin.win32\bdzsfx.x86.pdb

kernel32

lstrcmpW MulDiv SetFilePointerEx GetFileSizeEx SetFileAttributesW DeleteFileW SetFileTime SetEndOfFile WriteFile lstrcpyW GetVersion SetFileInformationByHandle DeviceIoControl SetLastError lstrlenW GetFullPathNameW lstrcatW WaitForSingleObject InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW SetEvent ResetEvent CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW CreateHardLinkW RemoveDirectoryW CreateSymbolicLinkW VirtualAlloc VirtualFree GetModuleFileNameW GetFileAttributesW GetCurrentThread FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime Sleep IsNormalizedString NormalizeString GlobalMemoryStatusEx CompareStringW CreateFileA GetDriveTypeW FlushFileBuffers GetTickCount FindClose GlobalFree GetSystemDirectoryW LoadLibraryW LocalFree MultiByteToWideChar lstrcmpiW InitializeCriticalSectionEx RaiseException GetCurrentThreadId GetUserDefaultLangID DecodePointer GetConsoleOutputCP GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetStdHandle GetConsoleMode LCMapStringW GetStdHandle GetCommandLineW GetCommandLineA ExitProcess GetFileType FreeLibraryAndExitThread ExitThread CreateThread TlsFree WriteConsoleW TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LoadLibraryExA IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead WideCharToMultiByte ReadFile CreateFileW FindResourceExW LoadResource FindResourceW LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetLastError FreeLibrary lstrcpynW GetModuleHandleExW CloseHandle GetCurrentProcess GetModuleHandleW LoadLibraryExW GetProcAddress EncodePointer OutputDebugStringW IsDebuggerPresent

user32

SendMessageW RegisterWindowMessageW GetDC SetFocus EndDialog KillTimer EnableWindow SetTimer SetDlgItemTextW PostMessageW MessageBoxW GetWindow MonitorFromWindow GetMonitorInfoW GetClientRect LoadIconW GetWindowTextW DialogBoxParamW UnregisterClassW GetActiveWindow CharNextW DispatchMessageW TranslateMessage PostQuitMessage PeekMessageW InvalidateRect ScreenToClient GetDlgItem CreateWindowExW DestroyWindow MoveWindow EnumChildWindows SetWindowLongW GetWindowLongW FindWindowExW GetClassNameW MapWindowPoints SetWindowTextW GetDlgCtrlID GetParent SetWindowPos SystemParametersInfoW MonitorFromPoint SetProcessDPIAware GetWindowRect ReleaseDC GetWindowTextLengthW

gdi32

CreateFontW DeleteObject GetStockObject GetDeviceCaps GetObjectW

advapi32

RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW AreAllAccessesGranted AccessCheck OpenThreadToken RevertToSelf ImpersonateSelf GetFileSecurityW GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW

ole32

CoInitialize CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathCanonicalizeW PathIsDirectoryW

Name

.text

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ve_share

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2c54a3bd0fd1c7e258dc73d184de932beb4e2854a1132aa83f6604ce3fb191c1

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

generic