tmpmzl58qa9

Sharing

Copy URL Twitter E-mail

General

Target
tmpmzl58qa9
Size 345KB
Sample260602-e5vxpadx9t
SHA256 50084561651bd5feb90cddc94985537715e4174b14f279f77c27f88cac8c303d
MD5 1a2d624e403577b2da1330db8de76f74
SHA1 250f869514519826152d29d4124e084be62b3a00
SHA512 fcfa83f34d2b495f2c37e0c77bc56a11ba51ce2042d24948d7a858dded05c71a1d972c83feef8ad01bdb44f377c305a8c5d9d1f90654b149f93ea3c8f1f3dc98
SSDEEP 6144:7i3kxmHzj1b3Qu8NTOY3hzM+fxM0wVJfdb0j/L9AvNy5vhk/:7isDJHSdb0j/BAa
TLSH
T17674E113BA80E4A6E05D153C0C7AC2DE22D7EC25E604A7377FA01F5D6D642F798B4CA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpmzl58qa9

File Explorer

tmpmzl58qa9

.exe 345KB

IMPHASH aa26544c7e2b6fe51563c03aa953b983
SHA256 50084561651bd5feb90cddc94985537715e4174b14f279f77c27f88cac8c303d
MD5 1a2d624e403577b2da1330db8de76f74
SHA1 250f869514519826152d29d4124e084be62b3a00
SHA512 fcfa83f34d2b495f2c37e0c77bc56a11ba51ce2042d24948d7a858dded05c71a1d972c83feef8ad01bdb44f377c305a8c5d9d1f90654b149f93ea3c8f1f3dc98
SSDEEP 6144:7i3kxmHzj1b3Qu8NTOY3hzM+fxM0wVJfdb0j/L9AvNy5vhk/:7isDJHSdb0j/BAa
TLSH
T17674E113BA80E4A6E05D153C0C7AC2DE22D7EC25E604A7377FA01F5D6D642F798B4CA9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20548

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeA

oleaut32

UnRegisterTypeLi SafeArrayDestroy SysStringByteLen VariantCopy VariantChangeType VariantInit SysAllocStringByteLen SafeArrayAccessData RegisterTypeLi SafeArrayUnaccessData SysAllocString SysAllocStringLen VarCmp SetErrorInfo LoadRegTypeLi SysFreeString VarUI4FromStr LoadTypeLi GetErrorInfo SafeArrayCreateVector DispCallFunc CreateErrorInfo VariantClear SysStringLen

gdi32

DeleteObject GetDeviceCaps CreateCompatibleBitmap GetPaletteEntries SelectObject GetStockObject GetCurrentObject CreateCompatibleDC CreateSolidBrush DeleteDC GetPixel SetDIBColorTable SetBkColor MaskBlt CreateBitmap CreateDIBSection GetObjectW BitBlt

comctl32

ImageList_AddMasked ImageList_GetImageCount ImageList_Create ImageList_Replace ImageList_GetIconSize ImageList_Add

shlwapi

SHCreateStreamOnFileW PathRemoveBlanksW SHStrDupW SHDeleteEmptyKeyW PathFileExistsW SHDeleteKeyW PathAppendW PathRemoveFileSpecW StrCmpW PathUnquoteSpacesW

esent

JetMakeKey JetMove JetCommitTransaction JetOpenDatabase JetSeek JetCloseDatabase JetGetTableColumnInfo JetEndSession JetFreeBuffer JetBeginTransaction JetAttachDatabase JetGetObjectInfo JetSetSystemParameter JetTerm JetSetIndexRange JetOpenTable JetRetrieveColumn JetInit JetBeginSession JetCloseTable JetGetTableIndexInfo JetCreateInstance JetDetachDatabase JetGetInstanceInfo JetCreateIndex JetSetCurrentIndex

ole32

CoCreateInstance CoRevokeClassObject CoResumeClassObjects CoTaskMemAlloc CoRegisterClassObject ReleaseStgMedium StringFromCLSID CLSIDFromProgID CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx CoSuspendClassObjects PropVariantClear CoTaskMemRealloc CoUninitialize

user32

IsWindowVisible KillTimer SetWindowsHookExW wsprintfW LoadImageW GetForegroundWindow ShowWindow GetParent GetSysColor DeleteMenu SetPropW ModifyMenuW DefWindowProcW ScreenToClient DestroyMenu IsChild PostThreadMessageW GetDlgItem RegisterClassExW GetWindow GetMessageW EqualRect GetWindowRect CallWindowProcW GetSystemMetrics LoadStringW IsWindow GetClassLongW UnhookWindowsHookEx GetMenuItemInfoW GetDesktopWindow SendMessageW FindWindowExW GetAncestor GetDC DispatchMessageW SetMenuItemInfoW IsMenu GetMenuItemCount RemovePropW TrackPopupMenu GetWindowInfo SetTimer ClientToScreen DestroyWindow MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW SetWindowLongW GetClassNameW CreatePopupMenu SetForegroundWindow UpdateWindow SetWindowPos EnumChildWindows ReleaseDC GetWindowLongW GetWindowThreadProcessId GetPropW TranslateMessage UnregisterClassW EnumThreadWindows keybd_event CharNextW InsertMenuItemW RegisterWindowMessageW CreateWindowExW SendMessageTimeoutW CallNextHookEx IntersectRect MsgWaitForMultipleObjects

shell32

SHGetFolderPathW

advapi32

GetSecurityDescriptorSacl RegOpenKeyW ConvertSidToStringSidW CryptGenRandom RegOpenKeyExW RegDeleteValueW SetSecurityDescriptorDacl AllocateAndInitializeSid CryptReleaseContext InitializeSecurityDescriptor RegNotifyChangeKeyValue RegEnumValueW CryptAcquireContextW RegQueryInfoKeyW GetAce GetSidSubAuthorityCount GetNamedSecurityInfoW RegQueryValueExW GetSidSubAuthority RegEnumKeyW RegCreateKeyExW SetNamedSecurityInfoW RegCloseKey SetSecurityDescriptorSacl GetSidIdentifierAuthority RegSetValueExA GetLengthSid FreeSid GetAclInformation GetUserNameW LookupAccountNameW AddAce RegDeleteKeyW RegEnumKeyExW InitializeAcl SetEntriesInAclW AddAccessAllowedAce ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW CloseServiceHandle AddAuditAccessAce AddAccessDeniedAceEx WmiOpenBlock BuildSecurityDescriptorW LsaGetUserName BuildExplicitAccessWithNameA LsaSetSystemAccessAccount CredWriteDomainCredentialsA StopTraceA ComputeAccessTokenFromCodeAuthzLevel RegSaveKeyExW LookupSecurityDescriptorPartsA OpenServiceW CryptSetProviderA MakeAbsoluteSD AddAuditAccessAceEx SaferGetLevelInformation InitiateSystemShutdownExA LsaSetSecret PrivilegedServiceAuditAlarmA I_ScSetServiceBitsA SetEntriesInAccessListW ConvertToAutoInheritPrivateObjectSecurity SaferIdentifyLevel LsaEnumeratePrivileges LsaOpenTrustedDomain BuildSecurityDescriptorA LsaLookupPrivilegeDisplayName SystemFunction023 CredFree IsTokenRestricted LsaGetRemoteUserName StopTraceW SystemFunction025 ElfOpenEventLogA MD5Update CommandLineFromMsiDescriptor CheckTokenMembership AbortSystemShutdownA ElfBackupEventLogFileW LookupAccountNameA AllocateLocallyUniqueId LookupPrivilegeValueW LsaGetQuotasForAccount ReadEventLogW GetExplicitEntriesFromAclA CreateCodeAuthzLevel LsaCreateAccount A_SHAUpdate CredReadW CredUnmarshalCredentialW ImpersonateAnonymousToken LookupPrivilegeValueA SaferiSearchMatchingHashRules ElfNumberOfRecords

kernel32

GlobalMemoryStatus FormatMessageA GetModuleHandleW HeapAlloc LoadResource GetAtomNameW CreateDirectoryW GetFileSize DeleteFileW ExpandEnvironmentStringsW HeapSize EnterCriticalSection DeleteCriticalSection HeapFree GlobalAlloc SizeofResource FreeLibrary LockResource LoadLibraryExW FindFirstFileW UnhandledExceptionFilter GetLocalTime FindNextFileW GetTempFileNameW ResetEvent TerminateThread MulDiv GetProcessHeap GlobalLock FormatMessageW CreateFileMappingW lstrlenW OutputDebugStringA MapViewOfFile CloseHandle SetLastError GetSystemInfo lstrcmpiW FindClose GetModuleHandleA IsDebuggerPresent RaiseException FreeLibraryAndExitThread GetModuleHandleExW HeapDestroy lstrcpynW GetTempPathW InitializeCriticalSectionAndSpinCount ReadFile CreateEventW OpenMutexW GetSystemTimeAsFileTime lstrcatW LocalFree VirtualProtect FindAtomW SetEndOfFile GetExitCodeThread UnmapViewOfFile WaitForMultipleObjectsEx MoveFileW ReleaseMutex LocalAlloc FindResourceExW LeaveCriticalSection VirtualQuery OpenEventW WaitForMultipleObjects OpenFileMappingW CopyFileW CreateThread WriteFile GlobalUnlock lstrcmpiA lstrlenA ResumeThread SetFilePointer CreateMutexW WideCharToMultiByte CreateFileW GetCurrentThreadId FindResourceW OutputDebugStringW GlobalFree WaitForSingleObject SetUnhandledExceptionFilter HeapReAlloc VirtualAlloc

rpcrt4

UuidCreateNil

oleacc

ObjectFromLresult

sensapi

IsDestinationReachableA IsNetworkAlive