9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe

Sharing

Copy URL Twitter E-mail

General

Target
9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe
Size 5.0MB
Sample260710-jfprlagv81
SHA256 9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe
MD5 013e063fec5ad58a972c9232aa8e1f25
SHA1 a880205b54daf19430e19aefbbb455d5382fecf8
SHA512 17542a76f47d15d0dbe83ef483ca4b4fb4ac4484731acacf23ccfefba7965fedef07a5b1cdb1816bca44218135ea9a803da35ccc280bf6597da427a4475b708d
SSDEEP 98304:6MMMKazIv2KWBpD6aCkO1aKA2stkMMMoRXFcOdA//OwNo10xuk6RzTciYPo:QazIv2bBpD6aCkOaKA2stIRXFcOdA/WB
TLSH
T195368D2078018531FBA20176D9BDFF6A489DCA750B6865D3A3D86D1F2EB01D32F32697
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe

File Explorer

9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe

.exe 5.0MB

9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe

IMPHASH 4611278cff99b1b3ddd8401f0d152c3c
SHA256 9fbf5340e701f63b1a03d11c4afd049b2c77b152787339f47a4c080410af9cbe
MD5 013e063fec5ad58a972c9232aa8e1f25
SHA1 a880205b54daf19430e19aefbbb455d5382fecf8
SHA512 17542a76f47d15d0dbe83ef483ca4b4fb4ac4484731acacf23ccfefba7965fedef07a5b1cdb1816bca44218135ea9a803da35ccc280bf6597da427a4475b708d
SSDEEP 98304:6MMMKazIv2KWBpD6aCkO1aKA2stkMMMoRXFcOdA//OwNo10xuk6RzTciYPo:QazIv2bBpD6aCkOaKA2stIRXFcOdA/WB
TLSH
T195368D2078018531FBA20176D9BDFF6A489DCA750B6865D3A3D86D1F2EB01D32F32697
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3120173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveOutReset waveInGetNumDevs waveInOpen waveInClose waveInPrepareHeader waveInReset waveOutWrite waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInStop waveInStart waveInAddBuffer

ss3dgfunc

BeginAnalyze EndAnalyze _CrossProduct@12 _SetInverseMatrix@8 _VECTOR3Length@4 _COLORtoDWORD@16 _WriteTGA@24 _Normalize@8 _SetRotationYMatrix@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16

wsock32

closesocket connect __WSAFDIsSet getsockopt htons recv select send setsockopt socket WSAStartup WSACleanup WSAGetLastError sendto recvfrom ntohs ioctlsocket getsockname bind gethostbyname inet_addr inet_ntoa

dinput8

DirectInput8Create

ws2_32

WSAIoctl inet_pton

wininet

HttpSendRequestA HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA

kernel32

ReleaseSemaphore FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode HeapSize EnumSystemLocalesW GetVersionExW VirtualAlloc GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetStartupInfoW CreateEventW SetLastError GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA InterlockedExchange InterlockedCompareExchange GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA OpenProcess TerminateProcess ReadFile CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte LCMapStringA GetSystemDefaultLangID GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process GlobalAlloc GlobalLock GlobalUnlock VirtualFree lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA Module32First Module32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime InitializeSListHead lstrcmpiA ExitProcess ReadProcessMemory VirtualProtect WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA GetModuleHandleW RemoveDirectoryA FindFirstFileA FindNextFileA CopyFileA MoveFileA Process32FirstW Process32NextW SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA GetTickCount64 QueryPerformanceCounter QueryPerformanceFrequency IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime UnhandledExceptionFilter GetCPInfo FatalAppExitA WriteConsoleW GetFileType GetStdHandle GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree SetProcessAffinityMask TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SwitchToThread SignalObjectAndWait WaitForSingleObjectEx SetEvent RtlCaptureStackBackTrace QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue IsProcessorFeaturePresent RtlUnwind GetStringTypeW EncodePointer GetExitCodeThread GetSystemTimeAsFileTime LoadLibraryW GetTimeZoneInformation FindFirstFileExW FindNextFileW FlushFileBuffers SetConsoleCtrlHandler GetFileAttributesExW CompareFileTime UnregisterWaitEx CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WaitForMultipleObjectsEx SetEnvironmentVariableA SetEndOfFile LocalFree lstrlenW GlobalFree SetThreadPriority

user32

GetCursorPos wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard GetWindow GetWindowThreadProcessId SetClipboardData EmptyClipboard GetTopWindow FindWindowExA EnumChildWindows GetWindowLongA GetWindowTextW IsWindowVisible IsWindow CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture PeekMessageA ScreenToClient OffsetRect GetDC ReleaseDC TranslateMessage DispatchMessageA DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow EndDialog GetSystemMetrics UpdateWindow EnumDisplayDevicesW SendMessageA GetAsyncKeyState GetClientRect LoadCursorFromFileA SetCursor UnregisterClassA GetMonitorInfoW MonitorFromWindow GetDesktopWindow LoadIconA FindWindowW ShowCursor

gdi32

CreateDCW CreateFontIndirectA DeleteObject GetTextExtentPoint32A SelectObject AddFontResourceExA RemoveFontResourceExA GetStockObject CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteDC

advapi32

OpenProcessToken RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey LookupPrivilegeValueA RegEnumKeyExW GetUserNameW OpenEventLogW GetNumberOfEventLogRecords RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW OpenThreadToken AdjustTokenPrivileges CloseEventLog

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VariantClear GetErrorInfo VariantChangeType SetErrorInfo VariantInit CreateErrorInfo

freeimage

_FreeImage_Load@12 _FreeImage_GetScanLine@8 _FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_GetInfo@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_SaveJPEG@12 _FreeImage_Allocate@24 _FreeImage_Save@16

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetModuleInformation GetMappedFileNameW GetProcessImageFileNameA GetModuleFileNameExA GetModuleFileNameExW EnumProcessModules

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty

gdiplus

GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdiplusShutdown GdipAlloc GdipFree

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=257, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=34, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=408, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=685, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,