tmp9yj99axe

Sharing

Copy URL Twitter E-mail

General

Target
tmp9yj99axe
Size 295KB
Sample260602-ffls6afs7j
SHA256 f97520f63f2da776332e6ff50da71f3e14020ebef7e4bb80c2bdb5c0011c5926
MD5 09eec664c53f2d90f2aec1d1d7b4bfc9
SHA1 37dbae7b5bb087799ded56c428de888b39ea3969
SHA512 c7f1d89d040011d700385bed4d0fff8048dde119f09a55d2772de68d46747028c4bc6fd61ab525992f423ee0c9306949579f8eb2b683045794d8c3bc51a7b9df
SSDEEP 6144:H/x18tNpRLpy/gbsWy5lZ85ssJ62HHYwzpUtZCNohaXF:AtNpryqy5QsZ2nZoR+F
TLSH
T11B540207FB88C12AC89A69B4C5775BFB531AED46831496D38D48BC8AECF27C15C326D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp9yj99axe

File Explorer

tmp9yj99axe

.exe 295KB

IMPHASH cf20d2de5ef33db74b557bd59ed805bb
SHA256 f97520f63f2da776332e6ff50da71f3e14020ebef7e4bb80c2bdb5c0011c5926
MD5 09eec664c53f2d90f2aec1d1d7b4bfc9
SHA1 37dbae7b5bb087799ded56c428de888b39ea3969
SHA512 c7f1d89d040011d700385bed4d0fff8048dde119f09a55d2772de68d46747028c4bc6fd61ab525992f423ee0c9306949579f8eb2b683045794d8c3bc51a7b9df
SSDEEP 6144:H/x18tNpRLpy/gbsWy5lZ85ssJ62HHYwzpUtZCNohaXF:AtNpryqy5QsZ2nZoR+F
TLSH
T11B540207FB88C12AC89A69B4C5775BFB531AED46831496D38D48BC8AECF27C15C326D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

wsprintfW UnregisterClassA

shlwapi

PathRemoveFileSpecW StrStrIW SHGetValueA

oleaut32

SafeArrayLock SafeArrayCopy VariantChangeType GetErrorInfo SafeArrayDestroy SafeArrayUnlock SysStringByteLen VariantCopy SafeArrayDestroyDescriptor VariantInit SafeArrayGetUBound GetRecordInfoFromGuids SafeArrayUnaccessData SafeArrayDestroyData LoadTypeLi SysAllocStringByteLen SysAllocStringLen VariantCopyInd SafeArrayCreate SafeArrayCreateVectorEx SafeArrayGetLBound LoadRegTypeLi VarBstrCmp SafeArrayGetVartype SafeArrayAccessData SysAllocString VarBstrCat SysFreeString SysStringLen VariantClear SafeArrayRedim

userenv

ExpandEnvironmentStringsForUserW UnloadUserProfile

ws2_32

sendto socket htons WSACleanup inet_addr WSAStartup closesocket

kernel32

GetFileInformationByHandle FindClose IsDebuggerPresent GetCurrentThreadId ConnectNamedPipe GetProcessHeap GetShortPathNameW SetThreadLocale HeapReAlloc WideCharToMultiByte OpenEventW GetDriveTypeW SizeofResource CreateFileW FindResourceExW HeapFree LCMapStringW HeapSize GetModuleHandleA HeapDestroy CreateThread CancelIo FormatMessageA MoveFileExW LeaveCriticalSection GetSystemTimeAsFileTime VerSetConditionMask GetLongPathNameW ExpandEnvironmentStringsW GetACP LocalFree WaitForSingleObject ReadFile GetOverlappedResult GetThreadLocale RaiseException HeapAlloc OpenProcess FindResourceW GetFileSize WriteFile FindFirstFileW LockResource OutputDebugStringA CreateEventW UnhandledExceptionFilter ResetEvent CloseHandle WaitForMultipleObjects CreateNamedPipeW VerifyVersionInfoW DisconnectNamedPipe lstrlenA FreeLibrary LoadResource QueryPerformanceFrequency OutputDebugStringW DeleteCriticalSection lstrlenW FormatMessageW GetModuleHandleW EnterCriticalSection GetVolumePathNameW SetLastError SetUnhandledExceptionFilter QueryDosDeviceW GetStartupInfoW VirtualAllocEx

ole32

CoInitializeEx CoCreateInstance CoUnmarshalInterface CoImpersonateClient CoUninitialize CoRevertToSelf CoMarshalInterThreadInterfaceInStream OleRun

advapi32

CopySid GetSecurityDescriptorControl SetThreadToken SetSecurityDescriptorDacl OpenProcessToken GetSecurityDescriptorDacl RevertToSelf GetTokenInformation InitializeSecurityDescriptor GetSidLengthRequired OpenThreadToken EqualSid ImpersonateNamedPipeClient GetSecurityDescriptorOwner RegCloseKey ConvertSidToStringSidW RegOpenKeyExW InitializeSid GetAclInformation AddAce GetSecurityDescriptorLength SetSecurityDescriptorOwner GetSidSubAuthority InitializeAcl GetLengthSid ConvertStringSidToSidW MakeAbsoluteSD RegOpenKeyW GetSecurityDescriptorGroup RegQueryValueExW GetSecurityDescriptorSacl IsValidSid MakeSelfRelativeSD

psapi

GetModuleFileNameExW

shell32

SHGetFolderPathW

comctl32

ImageList_LoadImageW ImageList_SetBkColor DrawInsert ImageList_DragShowNolock DestroyPropertySheetPage CreatePropertySheetPageA FlatSB_GetScrollInfo

kbdit

KbdLayerDescriptor