f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94

Sharing

Copy URL Twitter E-mail

General

Target
f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94
Size 8.1MB
Sample260701-vya7pscy2x
SHA256 f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94
MD5 59dfaed7e71ae98d1966c49927c6c88f
SHA1 73ac9efed2d998759f1c2b26d7c18edb82410ee6
SHA512 10e4ca829be60ee316d02c0f12459f4d284a31464b64c7f7a696bffbebf7d2a8e9b5e15466943569738c8a1cd63a55a76c753e7a8045257b2f480e505efb31da
SSDEEP 98304:M1Lz1E9uK0d1xASmLTaT4lwvLDjRx7GFOHwjjBi:O5E9uK0d1xASmLTrlwxwjjBi
TLSH
T14A869E11E943CED7E77909BA52A8CEECF1A6B6D093D9E1FB118034B4C415FF0687264A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94

File Explorer

f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94

.exe 8.1MB

f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94

IMPHASH 84b6ef579b13304ca8f5cf409a3a34d2
SHA256 f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94
MD5 59dfaed7e71ae98d1966c49927c6c88f
SHA1 73ac9efed2d998759f1c2b26d7c18edb82410ee6
SHA512 10e4ca829be60ee316d02c0f12459f4d284a31464b64c7f7a696bffbebf7d2a8e9b5e15466943569738c8a1cd63a55a76c753e7a8045257b2f480e505efb31da
SSDEEP 98304:M1Lz1E9uK0d1xASmLTaT4lwvLDjRx7GFOHwjjBi:O5E9uK0d1xASmLTrlwxwjjBi
TLSH
T14A869E11E943CED7E77909BA52A8CEECF1A6B6D093D9E1FB118034B4C415FF0687264A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

438400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\YYY\Y\_int\B3\debug\win32\debuger\B3333333333.pdb

kernel32

MulDiv DebugBreak InitializeCriticalSection GetTickCount FreeResource LoadResource LockResource SizeofResource FindResourceW FreeLibrary GetProcAddress LoadLibraryW GetUserDefaultLCID GetStdHandle GetCommandLineW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW CreatePipe PeekNamedPipe WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateProcessW GetSystemInfo GetVersionExW VirtualQuery GlobalFlags LocalFree FormatMessageW CopyFileW IsBadReadPtr IsBadWritePtr SetSystemPowerState MultiByteToWideChar WideCharToMultiByte GenerateConsoleCtrlEvent GetQueuedCompletionStatus SetEvent ResetEvent CreateThread SetThreadPriority FileTimeToLocalFileTime GetSystemTimeAsFileTime GetLocalTime SetLocalTime FileTimeToSystemTime LoadLibraryExW lstrcmpiW GlobalLock FlushFileBuffers GetStringTypeW SetStdHandle HeapQueryInformation SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect InitializeCriticalSectionEx IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileSizeEx GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetConsoleMode GetCurrentThread SetConsoleCtrlHandler HeapValidate GetCommandLineA WriteConsoleW GetFileType GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer InterlockedFlushSList InterlockedPushEntrySList RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalUnlock GlobalSize GlobalReAlloc GlobalAlloc TryEnterCriticalSection OutputDebugStringW GetProcessHandleCount DecodePointer OpenProcess TerminateProcess GetCurrentProcessId WriteFile GetModuleHandleW GetCurrentThreadId LeaveCriticalSection EnterCriticalSection RaiseException IsDebuggerPresent CreateEventW GetModuleFileNameW GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW IsBadStringPtrW GlobalFree Sleep CloseHandle CreateFileW IsBadStringPtrA ExitProcess DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError lstrcpynW SetEndOfFile

user32

SetActiveWindow UnregisterClassW MessageBoxW GetMessageW TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW DestroyWindow GetSystemMetrics GetClientRect CharNextW wsprintfW GetWindowRect LoadStringW SendMessageW PostMessageW RegisterClassW GetClassInfoW CreateWindowExW GetActiveWindow SetTimer SetPropW GetPropW RemovePropW GetWindowLongW GetDesktopWindow GetParent LoadCursorW LoadIconW LoadImageW CopyImage GetDC ExitWindowsEx AttachThreadInput WaitForInputIdle ShowWindow MoveWindow GetWindowDC GetKeyState GetMonitorInfoW MonitorFromWindow EnumDisplaySettingsW GetWindow GetWindowThreadProcessId EnumWindows InvalidateRect SetForegroundWindow IsWindowVisible UpdateWindow IsWindowEnabled SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard ReleaseDC

gdi32

GetObjectW CreateDIBSection GdiAlphaBlend SetStretchBltMode StretchBlt SelectPalette SelectObject RealizePalette GetSystemPaletteEntries GetStockObject GetDIBits GetDeviceCaps DeleteObject CreatePalette CreateCompatibleDC CreateCompatibleBitmap BitBlt CreateFontIndirectW GetTextExtentPoint32W SetDIBColorTable DeleteDC

advapi32

RegQueryValueW AdjustTokenPrivileges LookupPrivilegeValueW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegCreateKeyExW OpenProcessToken

shell32

DragAcceptFiles ShellExecuteW SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal CoUninitialize CoInitializeEx CoCreateInstance CLSIDFromString IIDFromString CLSIDFromProgID OleRun CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

LHashValOfNameSys VarCmp VariantChangeType VariantCopyInd VarUI4FromStr VariantTimeToSystemTime SystemTimeToVariantTime VarUdateFromDate OleCreatePictureIndirect OleCreateFontIndirect GetActiveObject RegisterTypeLi SysFreeString SysAllocString SysStringLen SafeArrayCreate SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData SafeArrayUnaccessData VariantInit VariantClear VariantCopy LoadTypeLi

comctl32

ImageList_Create InitCommonControlsEx ImageList_AddMasked ImageList_Destroy

ws2_32

WSAStartup WSACleanup

gdiplus

GdipBitmapLockBits GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipDeleteGraphics GdipGetImageWidth GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipBitmapUnlockBits GdipDrawImageRectI GdipSetCompositingMode GdipGetImageHeight GdipCreateBitmapFromScan0

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

536KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f4be5fa7058f14d0e981cd797ef7705654e89a96e5787de5e341059d1b380c94

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

gdiplus

generic