1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144

Sharing

Copy URL Twitter E-mail

General

Target
1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144
Size 228KB
Sample260710-t422yaft91
SHA256 1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144
MD5 989d243ba3fd996d2ef20b1eda8996b7
SHA1 73c123447bf43acb5785a63e35a2328199faf41e
SHA512 27807403dd119cf195d58a62e9ade2d279d7e25e35d7b1c1e53f2f356b2c3ba8cb9125f44a6cf5373b3d1aeafa3c4c3b44a4d88c044353746fdf2a1776f198db
SSDEEP 3072:HzGswSkW8jb7z+Pfr5z4gsNila+8rnc2Bws9vu9X/wr73kUUmutbcAGD590NN:qfJrz+PfrCXNi0UTXDOo
TLSH
T129346C0236D1C1B5D2AF127A48A79B2973B6BD608B71D2CB7F907E8E6E315C19D35302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144

File Explorer

1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144

.dll 228KB

1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144

IMPHASH 7b7b6fe0e82d6dc424413ea538cb2aed
SHA256 1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144
MD5 989d243ba3fd996d2ef20b1eda8996b7
SHA1 73c123447bf43acb5785a63e35a2328199faf41e
SHA512 27807403dd119cf195d58a62e9ade2d279d7e25e35d7b1c1e53f2f356b2c3ba8cb9125f44a6cf5373b3d1aeafa3c4c3b44a4d88c044353746fdf2a1776f198db
SSDEEP 3072:HzGswSkW8jb7z+Pfr5z4gsNila+8rnc2Bws9vu9X/wr73kUUmutbcAGD590NN:qfJrz+PfrCXNi0UTXDOo
TLSH
T129346C0236D1C1B5D2AF127A48A79B2973B6BD608B71D2CB7F907E8E6E315C19D35302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67649

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

w:\project\suresight\cust\vc2010\onvifsdk\main\onvif\release\OnvifDiscoveryLib.pdb

iphlpapi

GetAdaptersAddresses

rpcrt4

UuidCreate UuidToStringA

tools

??1BaseClass@@UAE@XZ ??0BaseClass@@QAE@XZ ?SetOnceMore@TimeTriggerItem@@QAEXXZ ?AddItem@TimeTriggerService@@QAEXPAVCallbackInterface@@HPAVBaseClass@@@Z ?GetTimeTriggerService@Environment@@QAEPAVTimeTriggerService@@H@Z ?GetInstance@Environment@@SAPAV1@XZ ?__Retain@BaseClass@@QAEXXZ ?__Release@BaseClass@@QAEXXZ ?GetRetainCount@BaseClass@@QAEHXZ

kernel32

GlobalDeleteAtom GlobalFindAtomW GlobalAddAtomW GetCurrentProcessId InterlockedIncrement GetVersion GlobalFlags InterlockedExchange GetCommandLineA HeapFree RtlUnwind RaiseException VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc HeapSize ExitProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetStringTypeW GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LoadLibraryA lstrcmpW GetVersionExA GetModuleHandleA GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile LoadLibraryW GetThreadLocale SetErrorMode GetCurrentThreadId CloseHandle TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GetModuleFileNameW GetModuleHandleW GetProcAddress GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree FreeLibrary lstrlenW SetLastError FindResourceW LoadResource LockResource SizeofResource Sleep WideCharToMultiByte GetProcessHeap HeapAlloc GetLastError MultiByteToWideChar

user32

SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus IsWindow GetWindowTextW GetForegroundWindow GetLastActivePopup GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos UnregisterClassA SetForegroundWindow GetClientRect GetMenu MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect PtInRect DefWindowProcW CallWindowProcW GetWindowLongW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow GetSysColor ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetSystemMetrics UnregisterClassW SetWindowsHookExW CallNextHookEx SendMessageW GetKeyState ValidateRect PostQuitMessage DestroyMenu UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu EnableWindow PostMessageW PeekMessageW DispatchMessageW LoadCursorW GetSysColorBrush GetWindowThreadProcessId IsWindowEnabled SetWindowTextW GetParent GetDlgCtrlID MapWindowPoints

gdi32

SetMapMode RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx DeleteDC CreateBitmap SetTextColor SetBkColor RestoreDC SaveDC GetStockObject GetDeviceCaps DeleteObject GetClipBox PtVisible

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

shlwapi

PathFindFileNameW PathFindExtensionW

oleaut32

VariantClear VariantChangeType VariantInit

ws2_32

gethostbyname closesocket htonl htons inet_addr accept inet_ntoa select bind WSAGetLastError WSASetLastError connect ntohs socket WSACleanup recvfrom WSAAsyncSelect send WSAStartup recv WSAAddressToStringW setsockopt sendto

Sharing

General

Malware Config

Signatures

File Explorer

1b6b0466611414dad3a7a4fbdf85f0aadce2fe4e507a860f65d6172a173b1144

iphlpapi

rpcrt4

tools

kernel32

user32

gdi32

winspool.drv

shlwapi

oleaut32

ws2_32

generic