15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213

Sharing

Copy URL Twitter E-mail

General

Target
15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213
Size 3.1MB
Sample260706-m4kdkad13x
SHA256 15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213
MD5 146496ce6311acec02fd296f076b9cc2
SHA1 e2b6d365367ee69dfdcaa7844b2641f8466cf7b3
SHA512 60c854aa7e4c46ce4d28355e5d788f3e6f070021c9f4c6114bc92fc0721c0e84d4f6bffd0fecacf297ece3aee032d6b5346ef11919838361fef499b40ca7dac7
SSDEEP 49152:smTofKkHyBHoPKGpC2WFjgR5J4iYcAkvF8U9So:M8QwiYc9vF8U
TLSH
T1E0E57C03A19644E5D1AAC0B4CE299232BB217C5D4BF175FF329077E82D72AE43739B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213

File Explorer

15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213

.exe 3.1MB

15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213

IMPHASH bc516cf73bb7e6483a564289fad8b4ab
SHA256 15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213
MD5 146496ce6311acec02fd296f076b9cc2
SHA1 e2b6d365367ee69dfdcaa7844b2641f8466cf7b3
SHA512 60c854aa7e4c46ce4d28355e5d788f3e6f070021c9f4c6114bc92fc0721c0e84d4f6bffd0fecacf297ece3aee032d6b5346ef11919838361fef499b40ca7dac7
SSDEEP 49152:smTofKkHyBHoPKGpC2WFjgR5J4iYcAkvF8U9So:M8QwiYc9vF8U
TLSH
T1E0E57C03A19644E5D1AAC0B4CE299232BB217C5D4BF175FF329077E82D72AE43739B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1646304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

platform_experience_helper.exe.pdb

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError RoOriginateErrorW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer WindowsIsStringEmpty WindowsStringHasEmbeddedNull

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory RoRegisterActivationFactories RoRevokeActivationFactories

propsys

InitPropVariantFromCLSID

secur32

GetUserNameExW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

advapi32

BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW CheckTokenMembership ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegSetKeyValueW RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

oleaut32

SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString VariantClear

shell32

CommandLineToArgvW SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

shlwapi

PathMatchSpecW

user32

AllowSetForegroundWindow CharUpperW EnumWindows GetActiveWindow GetAncestor GetClassNameW GetDesktopWindow GetWindowLongW GetWindowThreadProcessId LoadStringW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AllocConsole AssignProcessToJobObject AttachConsole CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileW CreateNamedPipeW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeInfo GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleFileNameExW LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFileEx MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetNamedPipeHandleState SetStdHandle SetThreadInformation SetThreadPriority SetThreadUILanguage SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WerRegisterRuntimeExceptionModule WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiW lstrlenA lstrlenW

ole32

CoAddRefServerProcess CoCreateInstance CoInitializeEx CoRegisterClassObject CoRegisterInitializeSpy CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRevokeInitializeSpy CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear StringFromCLSID

ntdll

NtClose NtOpenKeyEx NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

529B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

LZMADEC

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

15add1a892d54f6c02a624806bd7db3cbf61d58cfc1217cbf82318d498a10213

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

propsys

secur32

wtsapi32

advapi32

dbghelp

oleaut32

shell32

shlwapi

user32

version

winmm

kernel32

ole32

ntdll

userenv

generic