e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f

Sharing

Copy URL Twitter E-mail

General

Target
e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f
Size 1.3MB
Sample260710-mchewsav2v
SHA256 e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f
MD5 a553801acaf4079b2dc776972be37691
SHA1 b631a77ede027637d991bb2862cb6efb906417b8
SHA512 07eb2cbf934ff5af8de86a9af4590c883748e1e4bcb8816dad77b834df642df99851d2c78264f6eb7bf6db0b556fd81c3934662feaeafa4109f7844fa6d4b2d4
SSDEEP 24576:sZxmA9kOH0o/foPA1z+kHFpANa+Gkkj7bn0:UxVkgoPerpA8kkHI
TLSH
T14D55BF11B6C680B2C2C5253154AB6B3EA6369E054B15CBC3A36CFE6D5D333C3AE37295
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f

File Explorer

e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f

.exe 1.3MB

e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f

IMPHASH 0a86e8c0f70d22dbbe8b300081e7452e
SHA256 e8d1e8cd311cd3060b93f6b3e51f553b89ca50d95d79f76631c96efead724d4f
MD5 a553801acaf4079b2dc776972be37691
SHA1 b631a77ede027637d991bb2862cb6efb906417b8
SHA512 07eb2cbf934ff5af8de86a9af4590c883748e1e4bcb8816dad77b834df642df99851d2c78264f6eb7bf6db0b556fd81c3934662feaeafa4109f7844fa6d4b2d4
SSDEEP 24576:sZxmA9kOH0o/foPA1z+kHFpANa+Gkkj7bn0:UxVkgoPerpA8kkHI
TLSH
T14D55BF11B6C680B2C2C5253154AB6B3EA6369E054B15CBC3A36CFE6D5D333C3AE37295
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

599644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

rasapi32

RasHangUpA RasGetConnectStatusA

winmm

midiStreamClose midiStreamRestart midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart

ws2_32

recvfrom ioctlsocket recv WSAAsyncSelect closesocket send select getpeername accept ntohl WSACleanup WSAStartup inet_ntoa

kernel32

Process32Next Process32First CreateToolhelp32Snapshot SetFilePointer GetFileSize GetCurrentProcess TerminateProcess OpenProcess GetVersion TerminateThread CreateMutexA ReleaseMutex SuspendThread InterlockedIncrement InterlockedDecrement GetSystemInfo IsProcessorFeaturePresent lstrcmpiA LocalFree FileTimeToLocalFileTime lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile GlobalDeleteAtom GetSystemDirectoryA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime GetLocalTime RaiseException HeapSize GetACP SetStdHandle GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetLastError GetTimeZoneInformation FileTimeToSystemTime CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource InterlockedExchange LockResource ReadFile GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar CloseHandle GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock FindFirstFileA FindClose GetFileAttributesA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject GlobalFindAtomA

user32

ScrollWindowEx IsDialogMessageA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions LoadStringA GetSysColorBrush GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement GetNextDlgTabItem EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC CharUpperA GetWindowTextLengthA GetForegroundWindow GetWindowTextA GetDlgItem FindWindowA GetWindowThreadProcessId GetClassNameA GetDesktopWindow SetWindowTextA LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle GetScrollPos RegisterClassA ClientToScreen GetMenuItemCount GetWindowLongA UnregisterClassA

gdi32

PatBlt CreatePen GetObjectA SelectObject CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode CombineRgn CreateRectRgnIndirect SetBkColor CreateRectRgn SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA FillRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

comdlg32

GetOpenFileNameA GetFileTitleA GetSaveFileNameA ChooseColorA

advapi32

RegCreateKeyExA RegOpenKeyA RegQueryValueA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleInitialize OleUninitialize CLSIDFromString

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

wininet

InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetConnectA InternetSetOptionA InternetCloseHandle InternetCanonicalizeUrlA InternetOpenA

generic

count=9, id=11, version=8047,

count=6, id=10, version=8047,

count=5, id=12, version=7291,

count=44, id=19, version=8022,

count=49, id=14, version=7299,

count=2, id=93, version=2179,

count=1, id=28, version=9178,

count=6, id=18, version=8444,

count=117, id=29, version=9178,

count=9, id=95, version=2067,

count=697, id=1, productName=Unmarked objects,

count=29, id=19, version=8034,

count=226, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=113, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=101, id=11, productName=VS98 (6.0) build 8168, version=8168,

count=27, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=89, productName=Unmarked objects (old),

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,