ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37

Sharing

Copy URL Twitter E-mail

General

Target
ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37
Size 798KB
Sample260706-lshvxsc191
SHA256 ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37
MD5 73b70a5f5a7ecc168536932566564ee4
SHA1 824bbd088c0cd581971815abb516ee9bc5edd02d
SHA512 48624799fa548e17099d3d5aa63e797e8d21b7396717101a21a3c6e419b6dd04d628b89bfa0a07d2d42e2f3773d6a587810edf77eccc75a5c0c730e3b4dbf1d0
SSDEEP 12288:EcxxeBh+K9paZnVdkLsqE6wSiVsDhbal0XTUYXh4iB:EESh9DqHkAqgSrlGl0XTtR4iB
TLSH
T1A3056E2276E98036F2BF0A716E395655467A7D310EF1C08F73D0A94E2E71EC1DA26723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37

File Explorer

ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37

.dll 798KB

ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37

IMPHASH 740267081533c2b14c53346350a96fe8
SHA256 ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37
MD5 73b70a5f5a7ecc168536932566564ee4
SHA1 824bbd088c0cd581971815abb516ee9bc5edd02d
SHA512 48624799fa548e17099d3d5aa63e797e8d21b7396717101a21a3c6e419b6dd04d628b89bfa0a07d2d42e2f3773d6a587810edf77eccc75a5c0c730e3b4dbf1d0
SSDEEP 12288:EcxxeBh+K9paZnVdkLsqE6wSiVsDhbal0XTUYXh4iB:EESh9DqHkAqgSrlGl0XTtR4iB
TLSH
T1A3056E2276E98036F2BF0A716E395655467A7D310EF1C08F73D0A94E2E71EC1DA26723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

553330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CialloHook.pdb

kernel32

QueryPerformanceCounter FindFirstFileExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent DeleteCriticalSection GetTickCount64 GetModuleHandleExA GetEnvironmentStringsW FreeEnvironmentStringsW MapViewOfFile CreateFileMappingW GetSystemTime GetFileType GetSystemTimeAsFileTime CreateProcessW SystemTimeToFileTime AcquireSRWLockShared MoveFileExW CreateFileMappingA WriteConsoleW ReleaseSRWLockShared AcquireSRWLockExclusive GetUserDefaultLCID GetThreadUILanguage ReleaseSRWLockExclusive GetFileAttributesExW GetFileAttributesA GetFileInformationByHandle GetSystemDefaultLangID UnmapViewOfFile lstrlenA InitializeCriticalSection LeaveCriticalSection FindNextFileA GetUserDefaultUILanguage GetThreadLocale GetUserDefaultLangID SetFileTime RemoveDirectoryW GetSystemDefaultUILanguage ExpandEnvironmentStringsW GetStdHandle lstrlenW GetFullPathNameW IsDBCSLeadByteEx EnterCriticalSection SetConsoleTextAttribute GetConsoleScreenBufferInfo GetSystemDefaultLCID FindFirstFileA GetFileAttributesExA GetModuleFileNameA CreateDirectoryW InitializeSListHead VirtualQueryEx VirtualProtectEx VirtualFree VirtualAlloc SetThreadContext GetThreadContext ResumeThread SuspendThread SetFilePointerEx InitOnceExecuteOnce SetLastError RemoveVectoredExceptionHandler LoadLibraryExW FlushInstructionCache LoadLibraryA LoadLibraryExA VirtualProtect VirtualQuery CreateFileA SetFilePointer RaiseException SetEvent SetUnhandledExceptionFilter SetThreadStackGuarantee ResetEvent CreateThread GetCurrentThread DisableThreadLibraryCalls Sleep CreateEventW FreeLibraryAndExitThread WaitForSingleObject GetCurrentProcess GetTickCount lstrcmpiW WideCharToMultiByte FreeLibrary GetModuleHandleW GetCurrentProcessId ExitProcess GetFileSize GetProcAddress AddVectoredExceptionHandler GetCurrentDirectoryW GetLocalTime LoadLibraryW CloseHandle ReadFile GlobalFree DeleteFileW GlobalAlloc OutputDebugStringW GetLastError MultiByteToWideChar SetFileAttributesW GetACP GetSystemDirectoryW ReleaseMutex GetCurrentThreadId GetFileAttributesW CreateFileW FindClose CreateMutexW GetTempPathW GetEnvironmentVariableW SetEnvironmentVariableW GetModuleFileNameW GetModuleHandleExW WriteFile FindNextFileW GetCommandLineW GetFileSizeEx FindFirstFileW CopyFileW

user32

InsertMenuA EnumChildWindows MessageBoxW SendMessageW SetWindowTextW DialogBoxParamA IsWindow DialogBoxIndirectParamA SetMenuItemInfoA DrawTextA SetMenuItemInfoW SetDlgItemTextW SetWindowTextA SendDlgItemMessageW MessageBoxIndirectW DialogBoxIndirectParamW TabbedTextOutA EnumWindows GetMessageW DefWindowProcA MessageBoxA InsertMenuItemW SetWindowPos GetWindow ShowWindowAsync CreateWindowExA DrawTextExA ModifyMenuW SendDlgItemMessageA TabbedTextOutW CreateDialogParamW GetWindowThreadProcessId GetWindowLongW CreateWindowExW ShowWindow DispatchMessageW IsWindowVisible DrawTextExW GetDC ReleaseDC GetWindowTextW ModifyMenuA GetTabbedTextExtentA IsIconic MessageBoxIndirectA UnhookWinEvent InsertMenuItemA DialogBoxParamW IsWindowUnicode SetWinEventHook CreateDialogIndirectParamW DrawTextW AppendMenuW GetDlgItem GetTabbedTextExtentW AppendMenuA CreateDialogIndirectParamA SetWindowLongW CreateDialogParamA InsertMenuW SendMessageA SetDlgItemTextA DefWindowProcW

gdi32

GetTextExtentPointI GetGlyphIndicesW EnumFontFamiliesA EnumFontsA GetCharWidthFloatW GetCharacterPlacementW GetTextFaceW GetGlyphOutlineA GetTextExtentPointW GetGlyphIndicesA GetTextExtentExPointW GetCharWidthFloatA GetOutlineTextMetricsA RemoveFontResourceW GetKerningPairsW GetTextExtentPoint32A CreateFontA GetCharABCWidthsFloatA ExtTextOutA GetFontUnicodeRanges PolyTextOutA CreateFontIndirectExW AddFontResourceW GetFontData GetTextExtentPointA TextOutA AddFontResourceA GetTextExtentPoint32W TextOutW GetTextFaceA PolyTextOutW GetCharWidth32A GetTextMetricsW EnumFontFamiliesW AddFontResourceExA GetCharABCWidthsW GetObjectW GetTextExtentExPointI CreateFontIndirectA RemoveFontResourceA GetGlyphOutlineW GetCharABCWidthsFloatW RemoveFontMemResourceEx GetTextMetricsA CreateFontIndirectW GetCurrentObject GetCharWidthI GetOutlineTextMetricsW GetObjectType GetCharWidthA ExtTextOutW SetTextCharacterExtra GetObjectA GetCharWidthW CreateFontIndirectExA GetCharacterPlacementA GetCharABCWidthsI GetTextExtentExPointA GetCharABCWidthsA GetCharWidth32W CreateFontW RemoveFontResourceExA GetFontLanguageInfo EnumFontFamiliesExA GetKerningPairsA AddFontMemResourceEx EnumFontsW AddFontResourceExW EnumFontFamiliesExW RemoveFontResourceExW SelectObject CreateCompatibleDC DeleteDC DeleteObject

advapi32

RegOpenKeyW RegCloseKey RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegDeleteTreeW RegCreateKeyExW RegOpenKeyExA RegCreateKeyA RegQueryInfoKeyW RegOpenKeyA RegGetValueA RegQueryValueExA RegCreateKeyExA RegEnumKeyExW RegSetValueExA RegQueryInfoKeyA RegCreateKeyW RegEnumValueA RegEnumValueW RegEnumKeyExA RegGetValueW

ole32

CoTaskMemFree

msvcp140

??0_Lockit@std@@QAE@H@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?good@ios_base@std@@QBE_NXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ??Bios_base@std@@QBE_NXZ ??7ios_base@std@@QBE_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPBDH@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xinvalid_argument@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ

gdiplus

GdipDeleteFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipNewPrivateFontCollection GdipDeletePrivateFontCollection GdipPrivateAddFontFile GdipGetFamilyName GdiplusStartup GdiplusShutdown GdipFree GdipCloneFontFamily

vcruntime140

__std_exception_destroy __CxxFrameHandler3 wcsrchr __std_exception_copy wcschr __std_type_info_destroy_list wcsstr _CxxThrowException _except_handler4_common strrchr memcpy __current_exception_context memset memcmp __current_exception memmove __std_type_info_compare strchr __std_terminate

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vswprintf_s fseek __stdio_common_vsnwprintf_s _wfopen fgets ftell fflush __acrt_iob_func _wfopen_s _ftelli64 fclose _fseeki64 fwrite fputc fgetc fgetpos __stdio_common_vfprintf __stdio_common_vsprintf_s setvbuf _wfsopen ungetc fsetpos fread _get_stream_buffer_pointers

api-ms-win-crt-string-l1-1-0

wcscat_s strcmp strncpy_s strcpy_s strncmp wcsncmp towupper _stricmp isalnum toupper _wcsnicmp isspace iswalpha _wcsicmp iswspace wcscpy_s _strdup strncpy wcsncpy_s tolower towlower

api-ms-win-crt-runtime-l1-1-0

terminate _invoke_watson _seh_filter_dll _configure_narrow_argv _errno _initialize_narrow_environment _initterm_e _initterm _cexit abort _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table

api-ms-win-crt-convert-l1-1-0

wcstod wcstoull _ui64tow_s wcstoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_callnewh calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

shell32

SHGetKnownFolderPath

api-ms-win-crt-math-l1-1-0

ceil _dclass

CialloWinMMExportAnchor CloseDriver DefDriverProc DriverCallback DrvGetModuleHandle GetDriverModuleHandle GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW NotifyCallbackData OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW WOW32DriverCallback WOW32ResolveMultiMediaHandle WOWAppExit _FakeGetFileVersionInfoA@16 _FakeGetFileVersionInfoByHandle@16 _FakeGetFileVersionInfoExA@20 _FakeGetFileVersionInfoExW@20 _FakeGetFileVersionInfoSizeA@8 _FakeGetFileVersionInfoSizeExA@12 _FakeGetFileVersionInfoSizeExW@12 _FakeGetFileVersionInfoSizeW@8 _FakeGetFileVersionInfoW@16 _FakeVerFindFileA@32 _FakeVerFindFileW@32 _FakeVerInstallFileA@32 _FakeVerInstallFileW@32 _FakeVerLanguageNameA@12 _FakeVerLanguageNameW@12 _FakeVerQueryValueA@16 _FakeVerQueryValueW@16 aux32Message auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joy32Message joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mci32Message mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc mid32Message midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion mod32Message mxd32Message sndPlaySoundA sndPlaySoundW tid32Message timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite wid32Message wod32Message

Name

.text

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

558KB

Virtual Size

557KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

182KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ae2d25036da19edd61aa70f74dba5e1804080f2300db8b0d5eb8aac1834fbe37

kernel32

user32

gdi32

advapi32

ole32

msvcp140

gdiplus

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

api-ms-win-crt-math-l1-1-0

generic