3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2

Sharing

Copy URL Twitter E-mail

General

Target
3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2
Size 901KB
Sample260706-pynvxaft6s
SHA256 3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2
MD5 cbe83f0177ed8b8511ac133fdcd6f3be
SHA1 541e3b312dd2fe7703f8874d9dc796c713039a1a
SHA512 d9b52ad86896ed4aeb97cbafd3abba130a49c4c746430d38ebe8b1ff480704ca998cf53214b362555c260b344887e2081e3a20b04437e5aa840e53cfb563a510
SSDEEP 24576:8tHVizO7Mj8c9kvCHok+lBgykDZT6ZN0P2isq7kasEl6rOLybj:wHVit8c9k5lBg3DZuiP2isq7kasEl66O
TLSH
T16F155C19E7F502B8E5FBD5B5CE775417EBB3B84A4630C68E02A198492F33B50892E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2

File Explorer

3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2

.dll 901KB

3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2

IMPHASH 19a827a66055fa96bb3865e67c876790
SHA256 3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2
MD5 cbe83f0177ed8b8511ac133fdcd6f3be
SHA1 541e3b312dd2fe7703f8874d9dc796c713039a1a
SHA512 d9b52ad86896ed4aeb97cbafd3abba130a49c4c746430d38ebe8b1ff480704ca998cf53214b362555c260b344887e2081e3a20b04437e5aa840e53cfb563a510
SSDEEP 24576:8tHVizO7Mj8c9kvCHok+lBgykDZT6ZN0P2isq7kasEl6rOLybj:wHVit8c9k5lBg3DZuiP2isq7kasEl66O
TLSH
T16F155C19E7F502B8E5FBD5B5CE775417EBB3B84A4630C68E02A198492F33B50892E713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

648848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

CialloHook.pdb

kernel32

SetFileTime GetUserDefaultLangID GetThreadLocale GetUserDefaultUILanguage RemoveDirectoryW GetSystemDefaultUILanguage FindNextFileA LeaveCriticalSection InitializeCriticalSection SetFilePointer lstrlenA UnmapViewOfFile GetSystemDefaultLangID GetFileInformationByHandle GetFileAttributesA GetFileAttributesExW ExpandEnvironmentStringsW GetStdHandle lstrlenW ReleaseSRWLockExclusive IsDBCSLeadByteEx EnterCriticalSection SetConsoleTextAttribute GetConsoleScreenBufferInfo GetSystemDefaultLCID FindFirstFileA GetFileAttributesExA InitOnceExecuteOnce RemoveVectoredExceptionHandler CreateDirectoryW SystemTimeToFileTime CreateProcessW GetSystemTimeAsFileTime GetFileType GetSystemTime CreateFileMappingW MapViewOfFile GetThreadUILanguage GetUserDefaultLCID AcquireSRWLockExclusive ReleaseSRWLockShared WriteConsoleW FreeEnvironmentStringsW CopyFileW CreateFileMappingA MoveFileExW GetEnvironmentStringsW LoadLibraryExW LoadLibraryExA VirtualQueryEx VirtualProtectEx VirtualFree VirtualAlloc SetThreadContext GetModuleHandleExA GetTickCount64 GetThreadContext ResumeThread SuspendThread SetLastError DeleteCriticalSection FlushInstructionCache VirtualProtect GetModuleFileNameA VirtualQuery SetFilePointerEx CreateFileA QueryPerformanceCounter RtlCaptureContext ResetEvent RaiseException RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetEvent CreateEventW SetUnhandledExceptionFilter SetThreadStackGuarantee CreateThread GetCurrentThread DisableThreadLibraryCalls Sleep FreeLibraryAndExitThread ReadFile WaitForSingleObject GetCurrentProcess GlobalUnlock GetTickCount lstrcmpiW GetTempFileNameW WideCharToMultiByte FreeLibrary GetModuleHandleW GetCurrentProcessId ExitProcess GetFileSize GlobalLock GetProcAddress AddVectoredExceptionHandler GetCurrentDirectoryW GetLocalTime LoadLibraryW CloseHandle GlobalFree DeleteFileW GlobalAlloc OutputDebugStringW GetLastError MultiByteToWideChar SetFileAttributesW GetACP GetSystemDirectoryW ReleaseMutex GetCurrentThreadId GetFileAttributesW CreateFileW FindClose TerminateProcess CreateMutexW GetTempPathW GetEnvironmentVariableW SetEnvironmentVariableW GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW WriteFile FindNextFileW IsDebuggerPresent InitializeSListHead GetCommandLineW GetFileSizeEx FindFirstFileW GetFullPathNameW AcquireSRWLockShared

user32

CreateDialogParamW SendDlgItemMessageA ModifyMenuW ShowWindowAsync GetWindowThreadProcessId TabbedTextOutW SetDlgItemTextA ModifyMenuA InsertMenuItemW IsWindowVisible SetWindowPos DefWindowProcA InsertMenuA EnumChildWindows SetWindowLongPtrW SendMessageW SetWindowTextW DialogBoxParamA GetWindowLongPtrW IsWindow DialogBoxIndirectParamA SetMenuItemInfoA DrawTextA SetMenuItemInfoW SetDlgItemTextW SetWindowTextA SendDlgItemMessageW SendMessageA MessageBoxIndirectW InsertMenuW CreateDialogParamA DialogBoxIndirectParamW CreateDialogIndirectParamA TabbedTextOutA EnumWindows AppendMenuA GetTabbedTextExtentW GetDlgItem AppendMenuW DrawTextW CreateDialogIndirectParamW SetWinEventHook IsWindowUnicode DialogBoxParamW InsertMenuItemA UnhookWinEvent MessageBoxIndirectA IsIconic GetTabbedTextExtentA DrawTextExA CreateWindowExA DrawTextExW MessageBoxA GetMessageW DefWindowProcW DestroyWindow GetDC MessageBoxW CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetTimer TranslateMessage LoadCursorW SetCapture UpdateLayeredWindow KillTimer PostQuitMessage ReleaseCapture ReleaseDC GetCursorPos GetWindow GetWindowTextW

gdi32

GetCharacterPlacementW GetTextFaceW GetGlyphOutlineA GetTextExtentPointW GetGlyphIndicesA GetTextExtentExPointW GetCharWidthFloatA GetOutlineTextMetricsA RemoveFontResourceW GetKerningPairsW GetTextExtentPoint32A CreateFontA GetCharABCWidthsFloatA ExtTextOutA GetFontUnicodeRanges PolyTextOutA AddFontMemResourceEx EnumFontsA GetFontData GetTextExtentPointA TextOutA AddFontResourceA GetTextExtentPoint32W TextOutW GetTextFaceA PolyTextOutW GetCharWidth32A GetTextMetricsW GetCharWidthFloatW AddFontResourceExA AddFontResourceW CreateFontIndirectExW GetCharABCWidthsI GetTextExtentPointI GetGlyphIndicesW EnumFontFamiliesA GetCharABCWidthsW GetObjectW GetTextExtentExPointI CreateFontIndirectA RemoveFontResourceA GetGlyphOutlineW GetCharABCWidthsFloatW RemoveFontMemResourceEx GetTextMetricsA CreateFontIndirectW GetCurrentObject GetCharWidthI GetOutlineTextMetricsW GetObjectType GetCharWidthA ExtTextOutW SetTextCharacterExtra GetObjectA GetCharWidthW CreateFontIndirectExA GetFontLanguageInfo EnumFontFamiliesW GetTextExtentExPointA GetCharABCWidthsA EnumFontFamiliesExA GetKerningPairsA GetCharacterPlacementA GetCharWidth32W CreateFontW RemoveFontResourceExA EnumFontsW AddFontResourceExW EnumFontFamiliesExW RemoveFontResourceExW SelectObject CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC

advapi32

RegOpenKeyExA RegGetValueW RegCloseKey RegQueryValueExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegDeleteTreeW RegCreateKeyExW RegCreateKeyA RegQueryInfoKeyW RegOpenKeyA RegGetValueA RegQueryValueExA RegCreateKeyExA RegEnumKeyExW RegSetValueExA RegQueryInfoKeyA RegCreateKeyW RegEnumValueA RegEnumValueW RegEnumKeyExA RegOpenKeyW

ole32

CreateStreamOnHGlobal CoTaskMemFree

msvcp140

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

gdiplus

GdipDeleteFontFamily GdipGetFontCollectionFamilyList GdipGetFontCollectionFamilyCount GdipNewPrivateFontCollection GdipCloneFontFamily GdipDeleteMatrix GdipPrivateAddFontFile GdipGetFamilyName GdiplusStartup GdiplusShutdown GdipSetImageAttributesColorMatrix GdipCloneImage GdipRotateMatrix GdipScaleMatrix GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImageAttributes GdipCreateMatrix GdipDisposeImage GdipSetSmoothingMode GdipSetWorldTransform GdipSetInterpolationMode GdipGraphicsClear GdipCreateHBITMAPFromBitmap GdipSetPixelOffsetMode GdipCreateImageAttributes GdipFree GdipResetWorldTransform GdipTranslateMatrix GdipGetImageGraphicsContext GdipDeleteGraphics GdipSetCompositingMode GdipCreateBitmapFromScan0 GdipDrawImageRectRectI GdipDeletePrivateFontCollection

vcruntime140_1

__CxxFrameHandler4

vcruntime140

wcsstr memmove __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler wcsrchr strrchr memcpy memset _CxxThrowException wcschr __std_type_info_compare strchr memcmp __current_exception __current_exception_context __std_type_info_destroy_list

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vswprintf_s fclose __stdio_common_vsnwprintf_s _wfopen ftell fflush fgets _wfopen_s __stdio_common_vsnprintf_s __acrt_iob_func fseek _ftelli64 fwrite _wfsopen __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fgetc fputc __stdio_common_vfprintf

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s wcsncmp towlower strncpy_s _wcsicmp strcmp wcscat_s _wcsnicmp isspace iswalpha iswspace _strdup strncpy _stricmp tolower wcsncpy_s towupper wcscpy_s

api-ms-win-crt-runtime-l1-1-0

_cexit _seh_filter_dll _invoke_watson _configure_narrow_argv _initialize_narrow_environment _errno _initialize_onexit_table _initterm_e _initterm terminate _crt_atexit _execute_onexit_table _register_onexit_function

api-ms-win-crt-convert-l1-1-0

_wtol wcstod wcstoll wcstoull _ui64tow_s

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-heap-l1-1-0

calloc _callnewh malloc realloc free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

shell32

SHGetKnownFolderPath

api-ms-win-crt-math-l1-1-0

sqrtf ceilf _dclass

CialloWinMMExportAnchor CloseDriver DefDriverProc DriverCallback DrvGetModuleHandle FakeGetFileVersionInfoA FakeGetFileVersionInfoByHandle FakeGetFileVersionInfoExA FakeGetFileVersionInfoExW FakeGetFileVersionInfoSizeA FakeGetFileVersionInfoSizeExA FakeGetFileVersionInfoSizeExW FakeGetFileVersionInfoSizeW FakeGetFileVersionInfoW FakeVerFindFileA FakeVerFindFileW FakeVerInstallFileA FakeVerInstallFileW FakeVerLanguageNameA FakeVerLanguageNameW FakeVerQueryValueA FakeVerQueryValueW GetDriverModuleHandle GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW NotifyCallbackData OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW WOW32DriverCallback WOW32ResolveMultiMediaHandle WOWAppExit aux32Message auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joy32Message joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mci32Message mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc mid32Message midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion mod32Message mxd32Message sndPlaySoundA sndPlaySoundW tid32Message timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite wid32Message wod32Message

Name

.text

Size

648KB

Virtual Size

648KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3a9685d42c3347fa486d0b7f40c9afc69e28bede1bd15753ea3bf9cd17dfa5e2

kernel32

user32

gdi32

advapi32

ole32

msvcp140

gdiplus

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

shell32

api-ms-win-crt-math-l1-1-0

generic