2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2

Sharing

Copy URL Twitter E-mail

General

Target
2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2
Size 1.3MB
Sample260710-evyktsd191
SHA256 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2
MD5 3632319c767358c6f389f52798a51e09
SHA1 aedef04628d5a513bee7c785c13111301bbec7d2
SHA512 1148bf5e5ab7fd1a53cb3e4b6c8963c6ded48fc07b3817fd0103128abeffca0853decb962285c21e079d38d9d8ca8ea738c49ba7462129dd8254101a95798b2a
SSDEEP 24576:LHHUMMS3MsdwofKrMWFIiRqB1d6U1bHHd+dZZO0fMj:bPMScoCrMW6JvoU1bUHQ
TLSH
T12455BF16E3E641E8DC36CB388A656722F97178025F34A9DF1290472A3F73EA05E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2

File Explorer

2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2

.exe 1.3MB

2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2

IMPHASH f5c9d4ca36433bc0cb61faf1b17c5256
SHA256 2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2
MD5 3632319c767358c6f389f52798a51e09
SHA1 aedef04628d5a513bee7c785c13111301bbec7d2
SHA512 1148bf5e5ab7fd1a53cb3e4b6c8963c6ded48fc07b3817fd0103128abeffca0853decb962285c21e079d38d9d8ca8ea738c49ba7462129dd8254101a95798b2a
SSDEEP 24576:LHHUMMS3MsdwofKrMWFIiRqB1d6U1bHHd+dZZO0fMj:bPMScoCrMW6JvoU1bUHQ
TLSH
T12455BF16E3E641E8DC36CB388A656722F97178025F34A9DF1290472A3F73EA05E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

506992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CloseTrace ControlService ControlTraceA ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorA CreateServiceA DeleteService EnableTraceEx2 GetUserNameW InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA OpenTraceA ProcessTrace RegCloseKey RegCreateKeyExA RegGetKeySecurity RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetKeySecurity RegSetValueA RegSetValueExA RegisterServiceCtrlHandlerExA SetSecurityDescriptorDacl SetServiceStatus StartServiceA StartServiceCtrlDispatcherA StartTraceA SystemFunction036

dinput8

DirectInput8Create

ws2_32

WSAPoll WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname htons inet_addr ioctlsocket listen recv recvfrom send sendto setsockopt socket

version

GetFileVersionInfoW VerQueryValueA

user32

BringWindowToTop CheckDlgButton CloseClipboard CreateDialogIndirectParamW CreateWindowExW DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClassNameA GetClientRect GetClipboardData GetDlgItem GetDlgItemTextW GetForegroundWindow GetMessageW GetSubMenu GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsDialogMessageW IsDlgButtonChecked LoadIconA LoadIconW LoadImageA LoadMenuIndirectW MapVirtualKeyExA MapWindowPoints MessageBoxTimeoutW MessageBoxW MoveWindow OpenClipboard PostMessageW PostQuitMessage ScreenToClient SendMessageW SetClassLongPtrW SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage

ntdll

NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtResumeProcess NtSuspendProcess NtTerminateProcess NtUnmapViewOfSection RtlCaptureContext RtlCaptureStackBackTrace RtlCrc64 RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

oleaut32

SysAllocString SysFreeString

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoUninitialize

comctl32

InitCommonControlsEx

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA ord71 Shell_NotifyIconW

dbghelp

SymGetSymFromAddr64 SymInitialize

tdh

TdhGetEventInformation

gdi32

DeleteObject SetBkColor SetTextColor

iphlpapi

GetTcpTable2 SetTcpEntry

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile InternetSetOptionA

kernel32

CloseHandle CompareStringW CopyFileA CreateDirectoryA CreateDirectoryExA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultUILanguage GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process2 K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile MapViewOfFileEx MoveFileA MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringW Process32First Process32Next QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SignalObjectAndWait Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

664KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2477d3a15378883b97a1dcffce3e5e800fe1dd9f08ee2ed205830331464788e2

advapi32

dinput8

ws2_32

version

user32

ntdll

oleaut32

ole32

comctl32

shell32

dbghelp

tdh

gdi32

iphlpapi

wininet

kernel32

generic