tmp878rcisw

Sharing

Copy URL Twitter E-mail

General

Target
tmp878rcisw
Size 303KB
Sample260602-e5cfcadx8x
SHA256 b374c135c9724816e9b49d1a16765970cebf3d60ad0ca6c79333dc41f8f9460b
MD5 1abca9fd9600ad50970d7da3ade251ad
SHA1 fde43a7c330e6a6b2ede32e5813d6a0f2b1422d9
SHA512 1e57662884723e48aad0aa156e36683d01590dbea15489036904f0cf3ac769d9543f940dc674f5c07f7b17f766ee206a3ac9e1612230e4298cef32df18a03b46
SSDEEP 6144:I1ylZrzMQkhHNFr213x5p4zoTmdFQMuH8di4ia8iA3R4qZ0:+AZHz+NF21d0oW3ucdDiQCd
TLSH
T1DE641297307D8897D5FB4DBB55E332478D36A1EA821100532A26EB4DDC9B8C36F29B03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp878rcisw

File Explorer

tmp878rcisw

.exe 303KB

IMPHASH 26af20bdbf70dec16cd64b1078bbcbdd
SHA256 b374c135c9724816e9b49d1a16765970cebf3d60ad0ca6c79333dc41f8f9460b
MD5 1abca9fd9600ad50970d7da3ade251ad
SHA1 fde43a7c330e6a6b2ede32e5813d6a0f2b1422d9
SHA512 1e57662884723e48aad0aa156e36683d01590dbea15489036904f0cf3ac769d9543f940dc674f5c07f7b17f766ee206a3ac9e1612230e4298cef32df18a03b46
SSDEEP 6144:I1ylZrzMQkhHNFr213x5p4zoTmdFQMuH8di4ia8iA3R4qZ0:+AZHz+NF21d0oW3ucdDiQCd
TLSH
T1DE641297307D8897D5FB4DBB55E332478D36A1EA821100532A26EB4DDC9B8C36F29B03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18642

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

DragQueryFileW ShellExecuteExW

comctl32

ImageList_Create ImageList_ReplaceIcon ImageList_GetImageCount ImageList_Destroy ImageList_AddMasked CreateStatusWindow DllGetVersion FlatSB_SetScrollInfo ImageList_Remove ImageList_LoadImageA CreateToolbarEx InitCommonControlsEx UninitializeFlatSB MakeDragList CreateUpDownControl CreateToolbar FlatSB_GetScrollInfo

advapi32

RegDeleteKeyW RegCloseKey RegCreateKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW CryptReleaseContext CryptDestroyKey RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegQueryValueExW

user32

IsDlgButtonChecked MessageBoxW SendMessageW ReleaseCapture InvalidateRgn CreateWindowExW GetDesktopWindow CreateDialogIndirectParamW EnableWindow CharNextA CharNextW SetWindowPos GetClassNameW EndPaint IsChild InvalidateRect LoadStringW LoadStringA CreateAcceleratorTableW GetClientRect GetWindowTextW IsCharAlphaNumericW LoadBitmapW GetWindowTextLengthW IsDialogMessageW GetClassInfoExW GetDlgItemInt DispatchMessageW BeginPaint GetActiveWindow UnregisterClassA DestroyAcceleratorTable GetMonitorInfoW GetNextDlgTabItem SetDlgItemTextW IsWindowEnabled SetDlgItemInt SetFocus GetWindowLongW GetDlgItemTextW IsClipboardFormatAvailable DrawTextExW IsWindow GetWindowRect GetFocus LoadImageW PostMessageW GetParent EndDialog RedrawWindow GetSysColor GetCursorPos GetDlgItem TranslateMessage MapWindowPoints ShowWindow ScreenToClient ReleaseDC CheckDlgButton LoadCursorW RegisterWindowMessageW SetWindowTextW SetWindowLongW GetDialogBaseUnits LoadIconW CreateDialogParamW DefWindowProcW SetCapture DestroyWindow CallWindowProcW DialogBoxIndirectParamW RegisterClassExW GetDC RegisterClipboardFormatW EmptyClipboard SendDlgItemMessageW DrawFocusRect GetWindow MoveWindow SetCursor CharLowerBuffW PeekMessageW MonitorFromWindow OpenClipboard ClientToScreen GetKeyState DialogBoxParamW FillRect

gdi32

GetStockObject CreateFontIndirectW BitBlt CreateCompatibleDC CreateSolidBrush SetTextColor CreateBitmap CreateCompatibleBitmap ExtTextOutW SetBkColor GetTextExtentPoint32W GetDeviceCaps GetTextExtentPointW CopyMetaFileW SelectObject DeleteDC GetTextMetricsW DeleteObject GetObjectW

ole32

ReadClassStm OleSetClipboard CLSIDFromString CoGetClassObject OleGetClipboard GetHGlobalFromStream StringFromCLSID CreateDataAdviseHolder ReleaseStgMedium CreateStreamOnHGlobal OleLockRunning CoTaskMemFree OleInitialize CoTaskMemAlloc OleUninitialize StringFromGUID2 CoTaskMemRealloc OleDuplicateData CLSIDFromProgID CoGetMalloc CoCreateInstance

crypt32

CryptProtectData CryptUnprotectData

oleaut32

SafeArrayGetLBound LoadTypeLibEx SysStringLen LoadTypeLi SafeArrayGetVartype LoadRegTypeLi OleCreateFontIndirect SafeArrayRedim SysAllocStringLen VariantCopy SetErrorInfo SafeArrayGetUBound SafeArrayCreate SysFreeString VarBstrFromDate VarBstrCmp SafeArrayUnaccessData VariantChangeType SafeArrayAccessData VarUI4FromStr SysAllocStringByteLen VariantClear GetErrorInfo RegisterTypeLi VarBstrCat VariantChangeTypeEx SysAllocString VariantCopyInd SafeArrayDestroy SysStringByteLen SafeArrayLock UnRegisterTypeLi SafeArrayUnlock VariantInit

kernel32

SetFileAttributesW VirtualFree RemoveDirectoryW FlushInstructionCache FindClose SetLastError UnmapViewOfFile GetUserDefaultLCID CompareStringW MoveFileW GlobalFree FileTimeToSystemTime MapViewOfFile TlsGetValue GlobalReAlloc CloseHandle LoadLibraryExW GetCurrentThreadId FlushFileBuffers MulDiv TlsFree DeleteCriticalSection lstrcmpW GlobalLock WriteFile lstrlenA RaiseException InterlockedPushEntrySList FindResourceExW HeapDestroy GetComputerNameW TlsSetValue InitializeCriticalSectionAndSpinCount HeapSize CreateFileMappingA CreateFileW lstrlenW GetProcessHeap DeleteFileW SetFilePointer GlobalUnlock GlobalAlloc SetEndOfFile CreateFileA SizeofResource VirtualAlloc HeapFree FindFirstFileW SetUnhandledExceptionFilter HeapAlloc WideCharToMultiByte GetFullPathNameW LocalFree CopyFileW GetACP HeapReAlloc LeaveCriticalSection SetFileTime ReadFile FormatMessageW GetLocalTime FindNextFileW OpenFile UnhandledExceptionFilter LoadResource GetFileSize EnterCriticalSection FindResourceW IsDBCSLeadByte GlobalSize IsDebuggerPresent CreateDirectoryW TlsAlloc IsProcessorFeaturePresent FreeLibrary GetFileTime LockResource GetSystemTimeAsFileTime GetModuleHandleW GetFileType lstrcmpiW IsValidCodePage GetTempFileNameW InterlockedPopEntrySList GetFullPathNameA VirtualAllocEx

kbdgr1

KbdLayerDescriptor

Name

.text

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

74KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

140KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

56KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp878rcisw

shell32

comctl32

advapi32

user32

gdi32

ole32

crypt32

oleaut32

kernel32

kbdgr1

generic