582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac

Sharing

Copy URL Twitter E-mail

General

Target
582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac
Size 5.1MB
Sample260601-3decmaav4k
SHA256 582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac
MD5 d805e40aef941ae5b602b07e0e153c4f
SHA1 dc603209f04b7e20b8ad75e47f5321288d0f72ca
SHA512 d3cfe8c070aa5025e1e8e7684df41c2ff26dbdd20622efe356cb8032e32f6d7458acc5f560fd14a1ab555a6944c2f4a28a03789947d59272924c68a56b74f799
SSDEEP 98304:lMMMMeX0afwIFARv86x6cUJujXLU69MMMrOmNPMFeoM2L40xssm0iXB2v6c:NeX0afwIFARv86x6cUJujXLU6SOmNPMP
TLSH
T146367C21B841C171EAA10176D9BDFE6B589DCA710B6895C3A3C82D5F3EB06D31B322D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac

File Explorer

582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac

.exe 5.1MB

582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac

IMPHASH 2e2133d997325fb3a4eb9b140e223f6a
SHA256 582bc80d4a674471e69f98a129d5fa8c086f60a701c557319e6674454bddebac
MD5 d805e40aef941ae5b602b07e0e153c4f
SHA1 dc603209f04b7e20b8ad75e47f5321288d0f72ca
SHA512 d3cfe8c070aa5025e1e8e7684df41c2ff26dbdd20622efe356cb8032e32f6d7458acc5f560fd14a1ab555a6944c2f4a28a03789947d59272924c68a56b74f799
SSDEEP 98304:lMMMMeX0afwIFARv86x6cUJujXLU69MMMrOmNPMFeoM2L40xssm0iXB2v6c:NeX0afwIFARv86x6cUJujXLU6SOmNPMP
TLSH
T146367C21B841C171EAA10176D9BDFE6B589DCA710B6895C3A3C82D5F3EB06D31B322D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3122779

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveInClose waveInOpen waveInGetNumDevs waveOutReset waveOutWrite waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInPrepareHeader waveInReset waveInAddBuffer waveInStop waveInStart

ss3dgfunc

_Normalize@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16 _SetRotationYMatrix@8 _WriteTGA@24 _COLORtoDWORD@16 _VECTOR3Length@4 BeginAnalyze EndAnalyze _CrossProduct@12 _SetInverseMatrix@8

wsock32

connect htons select send setsockopt socket WSAStartup WSACleanup inet_addr gethostbyname closesocket bind getsockname WSAGetLastError sendto recvfrom ntohs ioctlsocket recv

dinput8

DirectInput8Create

ws2_32

inet_pton WSAIoctl

wininet

InternetConnectA HttpOpenRequestA HttpSendRequestA InternetOpenA InternetReadFile InternetOpenUrlA InternetCloseHandle

kernel32

ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetFileAttributesExW CreateDirectoryW GetConsoleMode HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA OpenProcess TerminateProcess ReadFile CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte LCMapStringA GetSystemDefaultLangID InterlockedExchange InterlockedCompareExchange GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process GlobalAlloc GlobalLock GlobalUnlock GlobalFree lstrlenA SetCurrentDirectoryA GetEnvironmentStringsW Module32First Module32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime CompareFileTime lstrcmpiA InitializeSListHead ReadProcessMemory SetThreadPriority WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA GetModuleHandleW RemoveDirectoryA FindFirstFileA FindNextFileA CopyFileA MoveFileA Process32FirstW Process32NextW SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA GetTickCount64 QueryPerformanceCounter QueryPerformanceFrequency IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime GetStartupInfoW CreateEventW SetLastError UnhandledExceptionFilter GetCPInfo FatalAppExitA WriteConsoleW GetFileType GetStdHandle GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue FreeEnvironmentStringsW TlsAlloc GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx SetEvent RtlCaptureStackBackTrace QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue IsProcessorFeaturePresent RtlUnwind EncodePointer GetStringTypeW GetExitCodeThread GetSystemTimeAsFileTime SetStdHandle WaitForMultipleObjectsEx SetEnvironmentVariableA SetEndOfFile LocalFree UnregisterWaitEx GetVersionExW VirtualAlloc VirtualFree VirtualProtect SetProcessAffinityMask LoadLibraryW GetTimeZoneInformation FindFirstFileExW SetConsoleCtrlHandler FlushFileBuffers FindNextFileW ExitProcess lstrlenW GetCurrentDirectoryA

user32

ReleaseDC wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetWindow GetWindowThreadProcessId GetTopWindow FindWindowExA CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient OffsetRect GetDC MessageBoxW DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow EndDialog GetSystemMetrics UpdateWindow ShowCursor FindWindowW LoadIconA GetDesktopWindow MonitorFromWindow GetMonitorInfoW UnregisterClassA SetCursor LoadCursorFromFileA GetClientRect EnumChildWindows GetWindowLongA GetWindowTextW IsWindowVisible IsWindow EnumDisplayDevicesW SendMessageA GetAsyncKeyState

gdi32

DeleteObject DeleteDC CreateDCW CreateCompatibleDC CreateCompatibleBitmap BitBlt GetStockObject RemoveFontResourceExA AddFontResourceExA SelectObject GetTextExtentPoint32A CreateFontIndirectA

advapi32

RegOpenKeyExA RegQueryInfoKeyW RegQueryValueExW RegEnumKeyExW RegCloseKey RegQueryInfoKeyA RegQueryValueExA OpenProcessToken OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA GetUserNameW OpenEventLogW RegOpenKeyExW CloseEventLog GetNumberOfEventLogRecords

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CreateStreamOnHGlobal

oleaut32

CreateErrorInfo SysAllocString SysFreeString VariantClear VariantInit SetErrorInfo VariantChangeType GetErrorInfo

freeimage

_FreeImage_Allocate@24 _FreeImage_Save@16 _FreeImage_GetScanLine@8 _FreeImage_SaveJPEG@12 _FreeImage_ConvertTo16Bits565@4 _FreeImage_Load@12 _FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_GetInfo@4

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetProcessImageFileNameA GetMappedFileNameW GetModuleFileNameExA EnumProcessModules GetModuleInformation

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptFinishHash BCryptHashData BCryptCreateHash

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpSetOption

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=258, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=410, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=685, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,