0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f

Sharing

Copy URL Twitter E-mail

General

Target
0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f
Size 7.8MB
Sample260702-msjynaew4m
SHA256 0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f
MD5 fe3a8fa4931a92ba6df0b5d9f5c058ff
SHA1 a26472a81a3168421bab0b06a56bd061fda2cbc4
SHA512 c08611cb091881b1f122fc50137c6409496057325aaf78802443a93e098410a6c3d3d200834474788febc607aa735cb6d9cabf69a96cf0df8e33458719c1f063
SSDEEP 196608:fPzcOgZIdoaMnCGCfUyUXJwbZBenJnnI:fAOgZIdDMwfUHJAZUJn
TLSH
T11C86E02B77A405E5C4A7C27894678663E7B2B82603719BDB42E0466D1F23FE12E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f

File Explorer

0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f

.dll 7.8MB

0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f

IMPHASH 9b2bd614d781f22b7a69767e3640c8fa
SHA256 0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f
MD5 fe3a8fa4931a92ba6df0b5d9f5c058ff
SHA1 a26472a81a3168421bab0b06a56bd061fda2cbc4
SHA512 c08611cb091881b1f122fc50137c6409496057325aaf78802443a93e098410a6c3d3d200834474788febc607aa735cb6d9cabf69a96cf0df8e33458719c1f063
SSDEEP 196608:fPzcOgZIdoaMnCGCfUyUXJwbZBenJnnI:fAOgZIdDMwfUHJAZUJn
TLSH
T11C86E02B77A405E5C4A7C27894678663E7B2B82603719BDB42E0466D1F23FE12E7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

334556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\AGG\Desktop\MinerControl\x64\GPU_ONLINE\MinerControl.pdb

ws2_32

__WSAFDIsSet freeaddrinfo sendto setsockopt accept getsockname ntohs select getaddrinfo recvfrom connect WSASetLastError getpeername getsockopt WSAIoctl ioctlsocket WSAStartup WSAGetLastError htons WSACleanup recv bind socket closesocket send listen gethostname

kernel32

Module32FirstW Process32NextW CreateToolhelp32Snapshot Module32NextW CreateDirectoryW WriteFile WideCharToMultiByte ReadFile MultiByteToWideChar GetCurrentDirectoryW FileTimeToSystemTime GetFileInformationByHandle CreateProcessW GetModuleHandleW LoadLibraryA GetComputerNameA WaitForSingleObject GetStartupInfoW CreatePipe FreeLibrary K32GetProcessImageFileNameW GetLogicalDriveStringsW GlobalAlloc lstrlenW GlobalFree QueryDosDeviceW lstrcmpiW lstrcatW lstrcpyW VirtualQuery VirtualFree VirtualAlloc GetThreadContext HeapReAlloc SetThreadContext HeapAlloc HeapFree Thread32First HeapCreate Thread32Next FlushInstructionCache OpenThread VirtualProtect GetCurrentThreadId SuspendThread ResumeThread GetProcessHeap Process32FirstW GetThreadLocale FormatMessageA GetEnvironmentVariableW K32GetProcessMemoryInfo FindFirstFileW SetEnvironmentVariableW GetModuleFileNameW LocalAlloc FindNextFileW LocalFree FreeConsole AttachConsole DisableThreadLibraryCalls MoveFileW QueryPerformanceCounter ReadProcessMemory CreateThread VerifyVersionInfoA GetModuleHandleA GetSystemDirectoryA VerSetConditionMask ExpandEnvironmentStringsA WaitForMultipleObjects PeekNamedPipe GetCurrentProcessId CloseHandle GetModuleFileNameA GetSystemInfo GetProcAddress GetLastError CreateFileW TerminateProcess Sleep LoadLibraryW OpenProcess GetCurrentProcess ExitThread FileTimeToLocalFileTime FindClose FindFirstFileExW GetDriveTypeW SystemTimeToTzSpecificLocalTime WaitForSingleObjectEx GetFullPathNameW SleepEx InitializeCriticalSectionEx GetTickCount64 SetEndOfFile OutputDebugStringW SetEnvironmentVariableA WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW LoadLibraryExW GetTimeZoneInformation ReadConsoleW GetOEMCP GetACP IsValidCodePage HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetLastError SetFilePointerEx GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCPInfo RtlUnwindEx GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection IsDebuggerPresent IsProcessorFeaturePresent GetSystemTimeAsFileTime ExitProcess GetModuleHandleExW AreFileApisANSI GetFileAttributesExW GetCommandLineA RtlPcToFileHeader RaiseException RtlLookupFunctionEntry

user32

MessageBoxW EnumWindows PostMessageW wsprintfW FindWindowW RegisterClassW GetWindowThreadProcessId CreateWindowExW LoadCursorW GetDC LoadIconW

gdi32

SetPixelFormat

advapi32

RegOpenKeyExW CryptReleaseContext CryptAcquireContextA RegSetValueExW RegCloseKey CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData RegEnumKeyExW CryptCreateHash RegEnumValueW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken CryptGetHashParam

shell32

CommandLineToArgvW

ole32

CoCreateGuid

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wldap32

ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord41 ord50 ord60 ord211 ord46 ord143 ord301

opengl32

wglCreateContext glGetString wglMakeCurrent

iphlpapi

GetAdaptersInfo

shlwapi

StrStrIW

Name

.text

Size

711KB

Virtual Size

2048.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

239KB

Virtual Size

2048.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

2048.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

2049.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6.8MB

Virtual Size

2049.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

2055.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0ff50f512b27af96197d21836e569812aa5ec10177608cf758bf9d7cd534f52f

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

version

wldap32

opengl32

iphlpapi

shlwapi

generic