3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea

Sharing

Copy URL Twitter E-mail

General

Target
3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea
Size 382KB
Sample260709-dtekwsc14x
SHA256 3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea
MD5 2e4e2d15ac532a645857c09e1dc92df5
SHA1 cd97dbb97d13dfbef50f5f286f931788ed02f194
SHA512 733df39e68661d387c64ee31957ba4aa07e73da8899ff936276b5680295ee4af43a707eab2cab5993f3a65e54df2962474f5811cf17bcc2522cb9278e430cea2
SSDEEP 6144:cBYqN8Um5IhCDBQbZdDvBpo1nFu/moGtmAOpGBcqQsct9eoylcAaIDYmFSEWTMrz:cBYquULhCDBQbZdDvBpo1nFu/YzV4Fv+
TLSH
T17D842B0AEB7694E1C47AC07D8153A62BF9B234998730D7D397518A0B2F233E8B93D751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea

File Explorer

3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea

.dll 382KB

3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea

IMPHASH 07f704d7a4fbea7c480cde9513e4f652
SHA256 3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea
MD5 2e4e2d15ac532a645857c09e1dc92df5
SHA1 cd97dbb97d13dfbef50f5f286f931788ed02f194
SHA512 733df39e68661d387c64ee31957ba4aa07e73da8899ff936276b5680295ee4af43a707eab2cab5993f3a65e54df2962474f5811cf17bcc2522cb9278e430cea2
SSDEEP 6144:cBYqN8Um5IhCDBQbZdDvBpo1nFu/moGtmAOpGBcqQsct9eoylcAaIDYmFSEWTMrz:cBYquULhCDBQbZdDvBpo1nFu/YzV4Fv+
TLSH
T17D842B0AEB7694E1C47AC07D8153A62BF9B234998730D7D397518A0B2F233E8B93D751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

195492

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d:\Project\ZC\ADH2\Small\PeiWanPopup__Test\Small\PeiWanPopup\x64\Release\PeiWanPopup.pdb

mfc90

ord265 ord2516 ord6303 ord2380 ord2602 ord2797 ord1039 ord877 ord888 ord2973 ord316 ord300 ord310 ord589 ord795 ord798 ord797 ord919 ord923 ord5609 ord2328 ord4179 ord6297 ord6295 ord6296 ord4206 ord5681 ord4095 ord588 ord6247 ord1523 ord305 ord3006 ord1516 ord280 ord776 ord1213 ord5333 ord5350 ord4041 ord5344 ord3002 ord1966 ord569 ord2342 ord760 ord3418 ord577 ord3923 ord5499 ord6348 ord5220 ord1023 ord3897 ord5701 ord2065 ord2110 ord4429 ord6407 ord3892 ord6409 ord3921 ord2303 ord5684 ord4677 ord5346 ord4112 ord771 ord3774 ord4136 ord4363 ord4586 ord4042 ord2709 ord3800 ord2904 ord4410 ord2780 ord2907 ord266 ord1103 ord1104 ord886 ord306 ord286 ord1019 ord791 ord799 ord3810 ord3809 ord2598 ord2711 ord790 ord296 ord2972 ord2344 ord2336 ord1472 ord4024 ord2814 ord643 ord394 ord5556 ord1018 ord4207 ord5647 ord5608 ord592 ord1239 ord320 ord1963 ord1205 ord1203 ord1229 ord1146 ord1195 ord379 ord1118 ord1238 ord1236 ord1111 ord1052 ord321 ord779 ord1060 ord2605 ord778

msvcr90

strncmp _snprintf _mbsupr strtoul _mbsnbcmp rand srand strncat _strnicmp calloc __CxxFrameHandler3 __C_specific_handler _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer ?terminate@@YAXXZ _vsnprintf _malloc_crt _initterm _initterm_e _encoded_null _amsg_exit __CppXcptFilter __crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QEAAXXZ __clean_type_info_names_internal _mbsstr _mbsnbicmp _mbsrchr _mbsnbcpy fclose strcpy_s fread fopen printf _vsnwprintf wcsstr _mbsicmp strncpy malloc free _purecall exit _time64 _invalid_parameter_noinfo _beginthread atoi strstr ??0exception@std@@QEAA@AEBV01@@Z ??0exception@std@@QEAA@AEBQEBD@Z ??0exception@std@@QEAA@XZ ??1exception@std@@UEAA@XZ ?what@exception@std@@UEBAPEBDXZ sprintf memmove_s _strlwr _stricmp _CxxThrowException

kernel32

SizeofResource GetFileAttributesA ReadFile FindFirstFileA RemoveDirectoryA SetFileAttributesA FindClose LockResource GetModuleFileNameA FindNextFileA GetComputerNameA Process32First OpenProcess CreateProcessA TerminateProcess Module32First LocalAlloc CreateToolhelp32Snapshot Module32Next WinExec GetTickCount GetCommandLineA InitializeCriticalSection Sleep GetLastError EnterCriticalSection GetModuleHandleA OutputDebugStringA DeleteFileA WaitForSingleObject SetEvent CreateEventA CloseHandle DeleteCriticalSection CreateThread LeaveCriticalSection CopyFileA CreateFileA SetUnhandledExceptionFilter GetCurrentProcess GetLocalTime GetCurrentThreadId GetCurrentProcessId LocalFree GetProcAddress DeviceIoControl WriteFile GetSystemTimeAsFileTime Process32Next WideCharToMultiByte MultiByteToWideChar GetFileSize FindResourceA SetFilePointer LoadResource SystemTimeToFileTime HeapFree GetProcessHeap QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter LocalFileTimeToFileTime GetCurrentDirectoryA CreateDirectoryA SetFileTime

user32

wsprintfA CharLowerA EndPaint GetClassNameA BeginPaint GetWindowLongA CreateWindowExA DefWindowProcA SetWindowPos GetCursorPos EnumChildWindows ShowWindow GetSysColorBrush GetSystemMetrics UpdateWindow LoadCursorA RegisterClassA GetMessageA GetWindowRect FindWindowExA TranslateMessage GetForegroundWindow GetWindowTextA WindowFromPoint GetWindowThreadProcessId DispatchMessageA

shell32

SHGetPathFromIDListA SHCreateDirectoryExA SHGetSpecialFolderLocation

shlwapi

PathFileExistsA

ole32

CoTaskMemFree

oleaut32

VariantClear

msvcp90

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ ??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEBV10@PEBD@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ

gdiplus

GdipCloneImage GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectI GdipDeleteGraphics GdipFree GdiplusStartup

iphlpapi

GetIpForwardTable GetIpNetTable GetAdaptersInfo

wininet

HttpSendRequestA HttpQueryInfoA InternetConnectA InternetReadFile HttpOpenRequestA HttpAddRequestHeadersA InternetOpenA InternetCloseHandle

psapi

GetModuleFileNameExW GetModuleFileNameExA

ws2_32

recvfrom send closesocket recv socket ntohs htons WSAGetLastError inet_addr inet_ntoa connect getpeername WSACleanup setsockopt WSAStartup accept listen bind htonl sendto

Name

.text

Size

207KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Editable

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3c1dceafbc9ed4b6520f2f467b39a9a6e60b9856c10fae5ed46ca32f80b7e2ea

mfc90

msvcr90

kernel32

user32

shell32

shlwapi

ole32

oleaut32

msvcp90

gdiplus

iphlpapi

wininet

psapi

ws2_32

generic