8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638

Sharing

Copy URL Twitter E-mail

General

Target
8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638
Size 427KB
Sample260706-lr74eshs6q
SHA256 8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638
MD5 095d0046395f0d7a95a3e8de129910fb
SHA1 9a884c4ca5ae1b59f79be06903ba159afae0e202
SHA512 a114996cc119f1a2fc56619c62ccd9df3610beb0fb99d4d5a958cd02a1aa98b747f2ea09edbaf07ccb088b4b1c953d4acbdbff58c1ddc954408414a655450169
SSDEEP 6144:wJskMaI1szk1RM0psjNKKAYZrfAbEVq/mGv40iAL97Y9yP4452AGmWe8cDt:w4vuaLkN4CrInXvNNY9SOGDt
TLSH
T108947C32E7E28036F07F06B0793AA54545797D310E72D08F6BD4689E29B8AD2DE35B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638

File Explorer

8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638

.dll 427KB

8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638

IMPHASH 7b837c1628b8a95f1a55af62d9c90a67
SHA256 8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638
MD5 095d0046395f0d7a95a3e8de129910fb
SHA1 9a884c4ca5ae1b59f79be06903ba159afae0e202
SHA512 a114996cc119f1a2fc56619c62ccd9df3610beb0fb99d4d5a958cd02a1aa98b747f2ea09edbaf07ccb088b4b1c953d4acbdbff58c1ddc954408414a655450169
SSDEEP 6144:wJskMaI1szk1RM0psjNKKAYZrfAbEVq/mGv40iAL97Y9yP4452AGmWe8cDt:w4vuaLkN4CrInXvNNY9SOGDt
TLSH
T108947C32E7E28036F07F06B0793AA54545797D310E72D08F6BD4689E29B8AD2DE35B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

286511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CialloHook.pdb

kernel32

GetFileAttributesExW GetFileAttributesA GetFileInformationByHandle GetSystemDefaultLangID UnmapViewOfFile SetFilePointer InitializeCriticalSection LeaveCriticalSection FindNextFileA GetUserDefaultUILanguage GetThreadLocale GetUserDefaultLangID SetFileTime RemoveDirectoryW CreateFileA GetStdHandle EnterCriticalSection SetConsoleTextAttribute GetConsoleScreenBufferInfo GetSystemDefaultLCID FindFirstFileA GetFileAttributesExA GetModuleFileNameA CreateDirectoryW GetModuleHandleExA GetTickCount64 DeleteCriticalSection QueryPerformanceCounter Sleep GetUserDefaultLCID GetThreadUILanguage UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetThreadContext WriteConsoleW IsDebuggerPresent SetFilePointerEx InitializeSListHead CreateFileMappingA MoveFileExW SystemTimeToFileTime GetSystemTimeAsFileTime GetFileType GetSystemTime CreateFileMappingW MapViewOfFile SetThreadContext VirtualQuery LoadLibraryExW FreeEnvironmentStringsW CopyFileW GetEnvironmentStringsW VirtualProtect InitOnceExecuteOnce SetLastError SetUnhandledExceptionFilter SetThreadStackGuarantee CreateThread GetCurrentThread DisableThreadLibraryCalls WaitForSingleObject GetCurrentProcess ReadFile lstrcmpiW WideCharToMultiByte FreeLibrary GetModuleHandleW GetCurrentProcessId ExitProcess GetFileSize SuspendThread GetProcAddress ResumeThread GetCurrentDirectoryW GetLocalTime LoadLibraryW CloseHandle VirtualFree DeleteFileW OutputDebugStringW GetLastError MultiByteToWideChar SetFileAttributesW GetACP GetSystemDirectoryW GetCurrentThreadId GetFileAttributesW CreateFileW VirtualProtectEx FindClose GetTempPathW GetEnvironmentVariableW SetEnvironmentVariableW VirtualQueryEx GetModuleFileNameW WriteFile FindNextFileW GetCommandLineW GetFileSizeEx FindFirstFileW GetSystemDefaultUILanguage FlushInstructionCache

user32

DialogBoxIndirectParamA SetMenuItemInfoA DrawTextA SetWindowTextA InsertMenuA SetWindowPos SendDlgItemMessageW DialogBoxParamA DialogBoxIndirectParamW ShowWindowAsync TabbedTextOutW CreateDialogParamW SetWindowTextW CreateWindowExA DrawTextExA SendDlgItemMessageA SendMessageW SetDlgItemTextA SendMessageA CreateDialogParamA CreateDialogIndirectParamA AppendMenuA GetTabbedTextExtentW DrawTextW CreateDialogIndirectParamW DialogBoxParamW InsertMenuItemA MessageBoxIndirectA TabbedTextOutA GetTabbedTextExtentA DrawTextExW DefWindowProcA MessageBoxA DefWindowProcW MessageBoxW CreateWindowExW ShowWindow ModifyMenuA

gdi32

GetCharABCWidthsI GetTextExtentPointI GetGlyphIndicesW EnumFontFamiliesA GetCharABCWidthsW GetObjectW GetTextExtentExPointI CreateFontIndirectA RemoveFontResourceA GetGlyphOutlineW GetCharABCWidthsFloatW RemoveFontMemResourceEx GetTextMetricsA CreateFontIndirectW EnumFontsW GetCharWidthFloatW GetCharacterPlacementW GetTextFaceW GetGlyphOutlineA GetGlyphIndicesA GetTextExtentExPointW GetCharWidthFloatA GetOutlineTextMetricsA RemoveFontResourceW CreateFontIndirectExW GetTextExtentPoint32A CreateFontA GetCharABCWidthsFloatA ExtTextOutA GetFontUnicodeRanges PolyTextOutA AddFontMemResourceEx EnumFontsA GetCharWidth32W CreateFontW RemoveFontResourceExA AddFontResourceW GetFontData GetFontLanguageInfo GetCharacterPlacementA GetKerningPairsA EnumFontFamiliesExA GetCharABCWidthsA GetTextExtentExPointA AddFontResourceExA EnumFontFamiliesW GetCharWidthI GetOutlineTextMetricsW GetCharWidthA ExtTextOutW GetObjectA SelectObject RemoveFontResourceExW EnumFontFamiliesExW GetCharWidthW GetTextMetricsW GetCharWidth32A PolyTextOutW GetTextFaceA TextOutW GetTextExtentPoint32W AddFontResourceA TextOutA GetKerningPairsW GetTextExtentPointW CreateFontIndirectExA GetTextExtentPointA

advapi32

RegCreateKeyExW RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegGetValueW RegOpenKeyW RegCreateKeyA RegQueryInfoKeyW RegOpenKeyA RegGetValueA RegQueryValueExA RegCreateKeyExA RegEnumKeyExW RegSetValueExA RegQueryInfoKeyA RegOpenKeyExA RegCreateKeyW RegEnumValueA RegEnumValueW RegEnumKeyExA

msvcp140

?_Xinvalid_argument@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Xbad_alloc@std@@YAXXZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??Bios_base@std@@QBE_NXZ ?good@ios_base@std@@QBE_NXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z

vcruntime140

__std_type_info_destroy_list memmove memcmp __CxxFrameHandler3 __std_exception_destroy __std_exception_copy __std_terminate memset wcschr __std_type_info_compare strchr strrchr memcpy __current_exception __current_exception_context _except_handler4_common _CxxThrowException

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vswprintf_s fflush __stdio_common_vsnwprintf_s ftell _wfopen_s fclose _wfopen fseek _ftelli64 fwrite fgets __acrt_iob_func _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fgetc fputc __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

_strdup strncpy_s strncpy wcscat_s _wcsnicmp _stricmp tolower towlower _wcsicmp iswalpha strcmp wcsncpy_s iswspace

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_dll _invoke_watson _configure_narrow_argv _initialize_narrow_environment _errno _initialize_onexit_table _initterm_e _initterm terminate _crt_atexit _execute_onexit_table _register_onexit_function

api-ms-win-crt-convert-l1-1-0

wcstoull _ui64tow_s wcstod wcstoll

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc calloc realloc

api-ms-win-crt-math-l1-1-0

ceil _dclass

CialloWinMMExportAnchor CloseDriver DefDriverProc DriverCallback DrvGetModuleHandle GetDriverModuleHandle GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW NotifyCallbackData OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW WOW32DriverCallback WOW32ResolveMultiMediaHandle WOWAppExit _FakeGetFileVersionInfoA@16 _FakeGetFileVersionInfoByHandle@16 _FakeGetFileVersionInfoExA@20 _FakeGetFileVersionInfoExW@20 _FakeGetFileVersionInfoSizeA@8 _FakeGetFileVersionInfoSizeExA@12 _FakeGetFileVersionInfoSizeExW@12 _FakeGetFileVersionInfoSizeW@8 _FakeGetFileVersionInfoW@16 _FakeVerFindFileA@32 _FakeVerFindFileW@32 _FakeVerInstallFileA@32 _FakeVerInstallFileW@32 _FakeVerLanguageNameA@12 _FakeVerLanguageNameW@12 _FakeVerQueryValueA@16 _FakeVerQueryValueW@16 aux32Message auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joy32Message joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mci32Message mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc mid32Message midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion mod32Message mxd32Message sndPlaySoundA sndPlaySoundW tid32Message timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite wid32Message wod32Message

Name

.text

Size

304KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.lpksc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8ab65680ec2ceda5e3ea6d51a5ced3f87917f2f76a5c9b0c979a77f6491ae638

kernel32

user32

gdi32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

generic