tmp3adfbhcs

Sharing

Copy URL Twitter E-mail

General

Target
tmp3adfbhcs
Size 259KB
Sample260602-fl152adz2v
SHA256 ff35325b3d786b337be2bd9afea6d9eac6b58a7b04169fc2cb3e2b7d66f57db5
MD5 f6c61eee545baa70b5baac2142dd8b82
SHA1 0f06a53a197f46234e9c92e89d853d7e272453ee
SHA512 1f05b4fb5a64dd0df0ff4fc23b0a64d88a071d098fb8b0547420012de659dfe8ee5e6ca037f52cf4aaee122ac9dbbbb491185d19819e6ebabeed7f46c82feeea
SSDEEP 6144:eyK4+vW9EnkxPWu9oYUkZYeLoerbZP4sdA9hmEPpW5rpH:hK99kPWqBU0LDrNgsdA9hFPW9
TLSH
T1C444AD8C69BCC6C1E89E657426B87B0CF1AD1C286576B1A8F9F346CD0E283817DA704D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp3adfbhcs

File Explorer

tmp3adfbhcs

.exe 259KB

IMPHASH 29fd9996b10182982c429e7b0516724d
SHA256 ff35325b3d786b337be2bd9afea6d9eac6b58a7b04169fc2cb3e2b7d66f57db5
MD5 f6c61eee545baa70b5baac2142dd8b82
SHA1 0f06a53a197f46234e9c92e89d853d7e272453ee
SHA512 1f05b4fb5a64dd0df0ff4fc23b0a64d88a071d098fb8b0547420012de659dfe8ee5e6ca037f52cf4aaee122ac9dbbbb491185d19819e6ebabeed7f46c82feeea
SSDEEP 6144:eyK4+vW9EnkxPWu9oYUkZYeLoerbZP4sdA9hmEPpW5rpH:hK99kPWqBU0LDrNgsdA9hFPW9
TLSH
T1C444AD8C69BCC6C1E89E657426B87B0CF1AD1C286576B1A8F9F346CD0E283817DA704D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

GetErrorInfo SafeArrayCreate SafeArrayGetLBound SafeArrayDestroy RegisterTypeLi SysStringByteLen SafeArrayGetUBound SysAllocStringLen SetErrorInfo UnRegisterTypeLi SafeArrayCopy VariantCopyInd SafeArrayGetVartype SysStringLen SysFreeString SafeArrayLock SafeArrayUnlock VariantClear LoadRegTypeLi CreateErrorInfo VariantInit SafeArrayRedim LoadTypeLi SysAllocString VariantChangeType SysAllocStringByteLen VariantCopy VarUI4FromStr

userenv

UnloadUserProfile

kernel32

CancelIo SetStdHandle WriteConsoleW GetOEMCP TlsAlloc FindResourceW EnterCriticalSection GetExitCodeThread OpenProcess GetCommandLineW VerifyVersionInfoW VirtualQuery HeapAlloc GetCommandLineA LeaveCriticalSection GetConsoleMode GetModuleHandleW IsValidCodePage HeapFree WideCharToMultiByte TlsGetValue SetConsoleCtrlHandler CloseHandle LCMapStringA DeleteCriticalSection GetConsoleOutputCP FreeLibrary GetProcessHeap lstrlenW GetModuleHandleA SetUnhandledExceptionFilter LocalFree CreateFileA SetProcessWorkingSetSize VirtualProtect VirtualFree lstrcmpiW WaitForSingleObject VerSetConditionMask HeapReAlloc GetDriveTypeW LCMapStringW DeviceIoControl GetCurrentThreadId SetLastError ResumeThread HeapDestroy CreateEventW GetThreadLocale LoadLibraryExW GetStdHandle GetACP SetProcessShutdownParameters GetSystemTimeAsFileTime GetFileType CreateThread TerminateThread RtlUnwind DuplicateHandle RaiseException UnhandledExceptionFilter EnumSystemLocalesA GetSystemInfo GetVolumeNameForVolumeMountPointW lstrlenA IsDebuggerPresent WriteFile IsValidLocale WriteConsoleA GetConsoleCP CreateProcessW FreeEnvironmentStringsA CreateWaitableTimerW HeapSize SetFilePointer FindResourceExW SetWaitableTimer FlushFileBuffers FreeEnvironmentStringsW SizeofResource LoadResource CreateFileW GetUserDefaultLCID WaitForMultipleObjects SetHandleCount LockResource VirtualAlloc TlsSetValue TlsFree GetStartupInfoW

shlwapi

PathRemoveFileSpecW PathQuoteSpacesW

user32

DispatchMessageW GetSysColorBrush RegisterClassW DestroyWindow PostThreadMessageW MsgWaitForMultipleObjects LoadCursorW CharNextW UnregisterClassA PeekMessageW TranslateMessage wsprintfW CreateWindowExW LoadStringW GetMessageW DefWindowProcW UnregisterClassW CharUpperBuffW

advapi32

QueryServiceConfigW RegisterEventSourceW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSidSubAuthority GetSecurityDescriptorOwner RegDeleteValueW QueryServiceStatusEx RegEnumKeyExW ConvertSecurityDescriptorToStringSecurityDescriptorW SetSecurityDescriptorGroup GetSecurityDescriptorDacl SetSecurityDescriptorOwner RegEnumValueW SetThreadToken GetAclInformation RegQueryValueExW RegOpenKeyExW AddAce StartServiceCtrlDispatcherW DeregisterEventSource OpenSCManagerW CopySid RegQueryInfoKeyW GetSidLengthRequired ControlService RegCloseKey SetServiceStatus InitializeAcl RegCreateKeyExW RegisterServiceCtrlHandlerW OpenServiceW GetSecurityDescriptorLength GetSecurityDescriptorGroup GetSecurityDescriptorSacl RegDeleteKeyW CreateServiceW MakeAbsoluteSD LookupAccountNameW InitializeSid ChangeServiceConfig2W GetTokenInformation CreateProcessAsUserW ReportEventW DeleteService IsValidSid EqualSid MakeSelfRelativeSD CloseServiceHandle SetNamedSecurityInfoW CheckTokenMembership DuplicateToken RegSetValueExW InitializeSecurityDescriptor GetLengthSid SetSecurityDescriptorDacl DuplicateTokenEx GetSecurityDescriptorControl ChangeServiceConfigW OpenThreadToken

setupapi

SetupDiCreateDeviceInfoListExW SetupDiSetDeviceRegistryPropertyW CM_Get_DevNode_Status_Ex SetupDiGetDeviceInstanceIdW CM_Get_Sibling CM_Get_Child SetupDiGetDeviceInfoListDetailW SetupDiGetClassDevsW CM_Get_Device_IDW CM_Get_Parent SetupDiOpenDeviceInfoW SetupDiGetDeviceInterfaceDetailW CM_Locate_DevNodeW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces CM_Get_Device_ID_Size SetupDiCreateDeviceInfoList SetupDiGetClassDevsExW

iphlpapi

NotifyAddrChange

ole32

OleRun CoTaskMemAlloc CoImpersonateClient CoUninitialize ProgIDFromCLSID CoTaskMemFree CoInitializeSecurity StringFromGUID2 CoCreateInstance CoInitializeEx StringFromCLSID CLSIDFromString CoTaskMemRealloc CoRevertToSelf CoRegisterClassObject CoResumeClassObjects CoRevokeClassObject CoSuspendClassObjects

mscms

CreateColorTransformA SetColorProfileElement UnregisterCMMW OpenColorProfileW CreateDeviceLinkProfile SpoolerCopyFileEvent InternalGetPS2ColorRenderingDictionary

kbdlt1

KbdLayerDescriptor

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bbihz

Size

512B

Virtual Size

613B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Tumzbi

Size

1KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Vbhc

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dR

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

212KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QwcF

Size

512B

Virtual Size

251B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp3adfbhcs

oleaut32

userenv

kernel32

shlwapi

user32

advapi32

setupapi

iphlpapi

ole32

mscms

kbdlt1

generic