86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598

Sharing

Copy URL Twitter E-mail

General

Target
86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598
Size 5.0MB
Sample260710-fyccfaex91
SHA256 86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598
MD5 d66e30319bc2e2d696e25f82bf823009
SHA1 534150d90eb682ec7e1349af438f2b58e5373083
SHA512 dfebf6827846cd83ab203adc5ad8c4a6c83d7403dda8df690340d8dbaed80d8da661ac96e87c10a4379ce81cd88a492766ec07fc360278739d8624f400821222
SSDEEP 98304:GMMMKazIv2KWBpD6aCkO1aKA2stkMMMoRXFcOdA//OwNo10xuk6RkTciEPo:sazIv2bBpD6aCkOaKA2stIRXFcOdA/Wg
TLSH
T1D2368D2078018531FBA20176D9BDFF6A489DCA750B6865D3A3D86D1F2EB01D32F32697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598

File Explorer

86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598

.exe 5.0MB

86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598

IMPHASH 4611278cff99b1b3ddd8401f0d152c3c
SHA256 86de3bbb7eb42698652bbfbaa383fb6af11975ccfc498c49d2c2dfade37e2598
MD5 d66e30319bc2e2d696e25f82bf823009
SHA1 534150d90eb682ec7e1349af438f2b58e5373083
SHA512 dfebf6827846cd83ab203adc5ad8c4a6c83d7403dda8df690340d8dbaed80d8da661ac96e87c10a4379ce81cd88a492766ec07fc360278739d8624f400821222
SSDEEP 98304:GMMMKazIv2KWBpD6aCkO1aKA2stkMMMoRXFcOdA//OwNo10xuk6RkTciEPo:sazIv2bBpD6aCkOaKA2stIRXFcOdA/Wg
TLSH
T1D2368D2078018531FBA20176D9BDFF6A489DCA750B6865D3A3D86D1F2EB01D32F32697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3120173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveOutReset waveInGetNumDevs waveInOpen waveInClose waveInPrepareHeader waveInReset waveOutWrite waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInStop waveInStart waveInAddBuffer

ss3dgfunc

BeginAnalyze EndAnalyze _CrossProduct@12 _SetInverseMatrix@8 _VECTOR3Length@4 _COLORtoDWORD@16 _WriteTGA@24 _Normalize@8 _SetRotationYMatrix@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16

wsock32

closesocket connect __WSAFDIsSet getsockopt htons recv select send setsockopt socket WSAStartup WSACleanup WSAGetLastError sendto recvfrom ntohs ioctlsocket getsockname bind gethostbyname inet_addr inet_ntoa

dinput8

DirectInput8Create

ws2_32

WSAIoctl inet_pton

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA

kernel32

ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode HeapSize EnumSystemLocalesW GetVersionExW VirtualAlloc GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetStartupInfoW CreateEventW SetLastError GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA InterlockedExchange InterlockedCompareExchange GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA OpenProcess TerminateProcess ReadFile CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte LCMapStringA GetSystemDefaultLangID GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process GlobalAlloc GlobalLock GlobalUnlock VirtualFree lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA Module32First Module32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime InitializeSListHead lstrcmpiA ExitProcess ReadProcessMemory VirtualProtect WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA GetModuleHandleW RemoveDirectoryA FindFirstFileA FindNextFileA CopyFileA MoveFileA Process32FirstW Process32NextW SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA GetTickCount64 QueryPerformanceCounter QueryPerformanceFrequency IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime UnhandledExceptionFilter GetCPInfo FatalAppExitA WriteConsoleW GetFileType GetStdHandle GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree SetProcessAffinityMask TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx SetEvent RtlCaptureStackBackTrace QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue IsProcessorFeaturePresent RtlUnwind GetStringTypeW EncodePointer GetExitCodeThread GetSystemTimeAsFileTime LoadLibraryW GetTimeZoneInformation FindFirstFileExW FindNextFileW FlushFileBuffers SetConsoleCtrlHandler GetFileAttributesExW CompareFileTime UnregisterWaitEx CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WaitForMultipleObjectsEx SetEnvironmentVariableA SetEndOfFile LocalFree lstrlenW GlobalFree SetThreadPriority

user32

GetCursorPos wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard GetWindow GetWindowThreadProcessId SetClipboardData EmptyClipboard GetTopWindow FindWindowExA EnumChildWindows GetWindowLongA GetWindowTextW IsWindowVisible IsWindow CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture PeekMessageA ScreenToClient OffsetRect GetDC ReleaseDC TranslateMessage DispatchMessageA DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow EndDialog GetSystemMetrics UpdateWindow EnumDisplayDevicesW SendMessageA GetAsyncKeyState GetClientRect LoadCursorFromFileA SetCursor UnregisterClassA GetMonitorInfoW MonitorFromWindow GetDesktopWindow LoadIconA FindWindowW ShowCursor

gdi32

CreateDCW CreateFontIndirectA DeleteObject GetTextExtentPoint32A SelectObject AddFontResourceExA RemoveFontResourceExA GetStockObject CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC

advapi32

OpenProcessToken RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey LookupPrivilegeValueA RegEnumKeyExW GetUserNameW OpenEventLogW GetNumberOfEventLogRecords RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW OpenThreadToken AdjustTokenPrivileges CloseEventLog

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VariantClear GetErrorInfo VariantChangeType SetErrorInfo VariantInit CreateErrorInfo

freeimage

_FreeImage_Load@12 _FreeImage_GetScanLine@8 _FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_GetInfo@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_SaveJPEG@12 _FreeImage_Allocate@24 _FreeImage_Save@16

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetModuleInformation GetMappedFileNameW GetProcessImageFileNameA GetModuleFileNameExA GetModuleFileNameExW EnumProcessModules

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=257, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=408, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=685, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,