20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7

Sharing

Copy URL Twitter E-mail

General

Target
20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7
Size 5.0MB
Sample260710-fyccfaex9z
SHA256 20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7
MD5 5a0a7b72956708cb14ee3598539bd464
SHA1 de0c07777173f704353597dbd078710867ac0aed
SHA512 526c5144cf7c35a161fadbc8b8a07f8164ef2d0a3e8dc4dd2d12400fdad5d78548cc1340f3e331d8c5e43385086e6ffa657b52702c6030fb73700803f573f057
SSDEEP 98304:0MMMKazIv2KWBpD6aCkO1aKA2stkMMMoRXFcOdA//OwNo10xuk6RNTciaPo:6azIv2bBpD6aCkOaKA2stIRXFcOdA/WJ
TLSH
T1CD368D2078018531FBA20176D9BDFF6A489DCA750B6865D3A3D86D1F2EB01D32F32697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7

File Explorer

20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7

.exe 5.0MB

20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7

IMPHASH 4611278cff99b1b3ddd8401f0d152c3c
SHA256 20c4567d19867c1a0bdc981988109683e401fdb7007291df209166ffc67e94a7
MD5 5a0a7b72956708cb14ee3598539bd464
SHA1 de0c07777173f704353597dbd078710867ac0aed
SHA512 526c5144cf7c35a161fadbc8b8a07f8164ef2d0a3e8dc4dd2d12400fdad5d78548cc1340f3e331d8c5e43385086e6ffa657b52702c6030fb73700803f573f057
SSDEEP 98304:0MMMKazIv2KWBpD6aCkO1aKA2stkMMMoRXFcOdA//OwNo10xuk6RNTciaPo:6azIv2bBpD6aCkOaKA2stIRXFcOdA/WJ
TLSH
T1CD368D2078018531FBA20176D9BDFF6A489DCA750B6865D3A3D86D1F2EB01D32F32697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3120173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveOutReset waveInGetNumDevs waveInOpen waveInClose waveInPrepareHeader waveInReset waveOutWrite waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInStop waveInStart waveInAddBuffer

ss3dgfunc

BeginAnalyze EndAnalyze _CrossProduct@12 _SetInverseMatrix@8 _VECTOR3Length@4 _COLORtoDWORD@16 _WriteTGA@24 _Normalize@8 _SetRotationYMatrix@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16

wsock32

closesocket connect __WSAFDIsSet getsockopt htons recv select send setsockopt socket WSAStartup WSACleanup WSAGetLastError sendto recvfrom ntohs ioctlsocket getsockname bind gethostbyname inet_addr inet_ntoa

dinput8

DirectInput8Create

ws2_32

WSAIoctl inet_pton

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA

kernel32

ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode HeapSize EnumSystemLocalesW GetVersionExW VirtualAlloc GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetStartupInfoW CreateEventW SetLastError GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA InterlockedExchange InterlockedCompareExchange GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA OpenProcess TerminateProcess ReadFile CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte LCMapStringA GetSystemDefaultLangID GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process GlobalAlloc GlobalLock GlobalUnlock VirtualFree lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA Module32First Module32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime InitializeSListHead lstrcmpiA ExitProcess ReadProcessMemory VirtualProtect WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA GetModuleHandleW RemoveDirectoryA FindFirstFileA FindNextFileA CopyFileA MoveFileA Process32FirstW Process32NextW SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA GetTickCount64 QueryPerformanceCounter QueryPerformanceFrequency IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime UnhandledExceptionFilter GetCPInfo FatalAppExitA WriteConsoleW GetFileType GetStdHandle GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree SetProcessAffinityMask TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx SetEvent RtlCaptureStackBackTrace QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue IsProcessorFeaturePresent RtlUnwind GetStringTypeW EncodePointer GetExitCodeThread GetSystemTimeAsFileTime LoadLibraryW GetTimeZoneInformation FindFirstFileExW FindNextFileW FlushFileBuffers SetConsoleCtrlHandler GetFileAttributesExW CompareFileTime UnregisterWaitEx CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WaitForMultipleObjectsEx SetEnvironmentVariableA SetEndOfFile LocalFree lstrlenW GlobalFree SetThreadPriority

user32

GetCursorPos wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard GetWindow GetWindowThreadProcessId SetClipboardData EmptyClipboard GetTopWindow FindWindowExA EnumChildWindows GetWindowLongA GetWindowTextW IsWindowVisible IsWindow CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture PeekMessageA ScreenToClient OffsetRect GetDC ReleaseDC TranslateMessage DispatchMessageA DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow EndDialog GetSystemMetrics UpdateWindow EnumDisplayDevicesW SendMessageA GetAsyncKeyState GetClientRect LoadCursorFromFileA SetCursor UnregisterClassA GetMonitorInfoW MonitorFromWindow GetDesktopWindow LoadIconA FindWindowW ShowCursor

gdi32

CreateDCW CreateFontIndirectA DeleteObject GetTextExtentPoint32A SelectObject AddFontResourceExA RemoveFontResourceExA GetStockObject CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC

advapi32

OpenProcessToken RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey LookupPrivilegeValueA RegEnumKeyExW GetUserNameW OpenEventLogW GetNumberOfEventLogRecords RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW OpenThreadToken AdjustTokenPrivileges CloseEventLog

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VariantClear GetErrorInfo VariantChangeType SetErrorInfo VariantInit CreateErrorInfo

freeimage

_FreeImage_Load@12 _FreeImage_GetScanLine@8 _FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_GetInfo@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_SaveJPEG@12 _FreeImage_Allocate@24 _FreeImage_Save@16

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetModuleInformation GetMappedFileNameW GetProcessImageFileNameA GetModuleFileNameExA GetModuleFileNameExW EnumProcessModules

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=257, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=408, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=685, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,