f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1

Sharing

Copy URL Twitter E-mail

General

Target
f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1
Size 1.5MB
Sample260706-pwxd9sft21
SHA256 f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1
MD5 ba602bdacf9cc0956854b7bb31917228
SHA1 641aca204b46d82d13404d090243ca5b53ae9d6b
SHA512 8d494e69d5b944d50aca2adf6d0a19d193c2881fc3b38abf1fdb9c6d86d94205f491ec5c23db6874cbbb6561ab7179eff728160e3c3ce6eaf98e69347ad10967
SSDEEP 24576:hdGBwGHCy1K2k3ZRv3kZRJAB4DG1z9cDen/Xg8+uk7jyr8uczW3S7ofx0e3A:hdZ8RMRwRJAB4acDkPdhkKouczWFxH3
TLSH
T1BC658C0AEBE633EDD8BBD038D9615111F5B17C252B017ADB124889675E33EF04A3BB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1

File Explorer

f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1

.exe 1.5MB

f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1

IMPHASH ababa30dc6edaeb3a69bb709075b8a2c
SHA256 f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1
MD5 ba602bdacf9cc0956854b7bb31917228
SHA1 641aca204b46d82d13404d090243ca5b53ae9d6b
SHA512 8d494e69d5b944d50aca2adf6d0a19d193c2881fc3b38abf1fdb9c6d86d94205f491ec5c23db6874cbbb6561ab7179eff728160e3c3ce6eaf98e69347ad10967
SSDEEP 24576:hdGBwGHCy1K2k3ZRv3kZRJAB4DG1z9cDen/Xg8+uk7jyr8uczW3S7ofx0e3A:hdZ8RMRwRJAB4acDkPdhkKouczWFxH3
TLSH
T1BC658C0AEBE633EDD8BBD038D9615111F5B17C252B017ADB124889675E33EF04A3BB19
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

495924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Working\Test\AsusSplendid\x64\Release\AsusSplendid.pdb

user32

SendMessageTimeoutW GetForegroundWindow GetWindowTextW GetWindowThreadProcessId QueryDisplayConfig GetDisplayConfigBufferSizes DisplayConfigGetDeviceInfo ReleaseDC RedrawWindow wsprintfW

gdi32

SetDeviceGammaRamp GetDeviceGammaRamp CreateDCW

shlwapi

PathFileExistsW

api-ms-win-core-synch-l1-1-0

OpenEventW OpenMutexW DeleteCriticalSection CreateEventW CreateMutexW SetEvent InitializeCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount WaitForSingleObject

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress SizeofResource LockResource LoadLibraryExW FreeLibrary GetModuleFileNameW LoadResource GetModuleHandleExW GetModuleFileNameA GetModuleHandleW

api-ms-win-core-registry-l1-1-0

RegCloseKey RegQueryValueExW RegEnumKeyExW RegOpenKeyExW

api-ms-win-core-privateprofile-l1-1-0

GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent SetProcessMitigationPolicy

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter RaiseException SetLastError SetUnhandledExceptionFilter GetLastError

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW TlsSetValue TerminateProcess TlsFree GetCurrentProcessId GetCurrentThreadId GetCurrentProcess SwitchToThread TlsAlloc ExitProcess CreateProcessW CreateProcessA TlsGetValue

ext-ms-win-shell32-shellfolders-l1-1-0

SHGetSpecialFolderPathW

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW GetStdHandle GetEnvironmentStringsW SetEnvironmentVariableA GetCommandLineA SetStdHandle GetCurrentDirectoryW GetCommandLineW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTime GetSystemDirectoryW GetSystemTimeAsFileTime

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW

api-ms-win-core-com-l1-1-0

CoInitializeEx CoSetProxyBlanket CoUninitialize CoCreateInstance CLSIDFromProgID CoInitializeSecurity

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime GetTimeZoneInformation FileTimeToSystemTime

api-ms-win-core-file-l1-1-0

GetFileType SetFilePointerEx DeleteFileW GetFileAttributesW GetFileInformationByHandle SetEndOfFile GetFileAttributesExW FindFirstFileExA WriteFile FindNextFileA GetFileSize GetFullPathNameW FindFirstFileW CreateFileW FlushFileBuffers FindClose ReadFile

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId MoveFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

oleaut32

SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetElement SafeArrayGetDim VariantClear VariantInit SysFreeString SafeArrayGetElemsize SysAllocString

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-heap-l1-1-0

HeapReAlloc GetProcessHeap HeapSize HeapFree HeapAlloc

api-ms-win-core-debug-l1-1-0

OutputDebugStringA OutputDebugStringW IsDebuggerPresent

api-ms-win-core-string-l1-1-0

WideCharToMultiByte CompareStringW GetStringTypeW MultiByteToWideChar

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-string-obsolete-l1-1-0

lstrcatW lstrcmpA

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

mscms

UninstallColorProfileW AssociateColorProfileWithDeviceW InstallColorProfileW DisassociateColorProfileFromDeviceW

shell32

CommandLineToArgvW

api-ms-win-core-localization-l1-2-0

GetACP GetUserDefaultLCID EnumSystemLocalesW GetLocaleInfoW LCMapStringW IsValidLocale GetOEMCP IsValidCodePage GetCPInfo

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlUnwind RtlVirtualUnwind RtlPcToFileHeader RtlCaptureContext RtlUnwindEx

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-console-l1-1-0

ReadConsoleW WriteConsoleW GetConsoleMode GetConsoleCP

Name

.text

Size

655KB

Virtual Size

654KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

f0b5c15bdfac9ae91ac7bfdc5713295857e01297f62d79e220f89a9361c6c8d1

user32

gdi32

shlwapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-privateprofile-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

ext-ms-win-shell32-shellfolders-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-com-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-2

api-ms-win-core-psapi-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-io-l1-1-0

oleaut32

api-ms-win-core-util-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

crypt32

wintrust

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

mscms

shell32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-console-l1-1-0

generic