bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7

Sharing

Copy URL Twitter E-mail

General

Target
bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7
Size 1.3MB
Sample260712-e5vlxscy8n
SHA256 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7
MD5 c150b4c8b0020581a242fd1c8e5d6ed1
SHA1 2e0523a2fb428b013d24d2e99ace638f51c821ce
SHA512 7a34217edb989c03a71e1ea7889827f466719251216a330146abe1fca1e588b1161bf70923cd92f68658d4fab75546840d4743bddaeb79c8e4388c8604f3111e
SSDEEP 24576:L2UCkpSEu2tMeTLqX/ZhBE+2ikN9HmdJxEcxePMMhIh:skpfwEqXxM3lN9BHkMhI
TLSH
T13255BF16E2E640E8D876CB788A656722F97178025F34A9DF13D0432A3F73EA05E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7

File Explorer

bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7

.exe 1.3MB

bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7

IMPHASH 53cdf9f8b9235e1a02656c7611f8559c
SHA256 bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7
MD5 c150b4c8b0020581a242fd1c8e5d6ed1
SHA1 2e0523a2fb428b013d24d2e99ace638f51c821ce
SHA512 7a34217edb989c03a71e1ea7889827f466719251216a330146abe1fca1e588b1161bf70923cd92f68658d4fab75546840d4743bddaeb79c8e4388c8604f3111e
SSDEEP 24576:L2UCkpSEu2tMeTLqX/ZhBE+2ikN9HmdJxEcxePMMhIh:skpfwEqXxM3lN9BHkMhI
TLSH
T13255BF16E2E640E8D876CB788A656722F97178025F34A9DF13D0432A3F73EA05E3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

506928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges ChangeServiceConfigA CloseServiceHandle CloseTrace ControlService ControlTraceA ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorA CreateServiceA DeleteService EnableTraceEx2 GetUserNameW InitializeSecurityDescriptor LookupPrivilegeValueA OpenProcessToken OpenSCManagerA OpenServiceA OpenTraceA ProcessTrace RegCloseKey RegCreateKeyExA RegGetKeySecurity RegOpenKeyA RegOpenKeyExA RegQueryValueExA RegSetKeySecurity RegSetValueA RegSetValueExA RegisterServiceCtrlHandlerExA SetSecurityDescriptorDacl SetServiceStatus StartServiceA StartServiceCtrlDispatcherA StartTraceA SystemFunction036

dinput8

DirectInput8Create

ws2_32

WSAPoll WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname htons inet_addr ioctlsocket listen recv recvfrom send sendto setsockopt socket

version

GetFileVersionInfoW VerQueryValueA

user32

BringWindowToTop CheckDlgButton CloseClipboard CreateDialogIndirectParamW CreateWindowExW DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClassNameA GetClientRect GetClipboardData GetDlgItem GetDlgItemTextW GetForegroundWindow GetMessageW GetSubMenu GetSysColor GetSysColorBrush GetWindowLongPtrW GetWindowRect GetWindowTextW GetWindowThreadProcessId IsClipboardFormatAvailable IsDialogMessageW IsDlgButtonChecked LoadIconA LoadIconW LoadImageA LoadMenuIndirectW LoadStringW MapVirtualKeyExA MapWindowPoints MessageBoxTimeoutW MessageBoxW MoveWindow OpenClipboard PostMessageW PostQuitMessage ScreenToClient SendMessageW SetClassLongPtrW SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage

ntdll

NtQueryInformationProcess NtQueryVirtualMemory NtReadVirtualMemory NtResumeProcess NtSuspendProcess NtTerminateProcess NtUnmapViewOfSection RtlCaptureContext RtlCaptureStackBackTrace RtlCrc64 RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind

oleaut32

SysAllocString SysFreeString

ole32

CoAllowSetForegroundWindow CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoUninitialize

comctl32

InitCommonControlsEx

shell32

DragAcceptFiles DragFinish DragQueryFileA ShellExecuteA ord71 Shell_NotifyIconW

dbghelp

SymGetSymFromAddr64 SymInitialize

tdh

TdhGetEventInformation

gdi32

DeleteObject SetBkColor SetTextColor

iphlpapi

GetTcpTable2 SetTcpEntry

wininet

HttpAddRequestHeadersA HttpOpenRequestA HttpSendRequestA InternetCloseHandle InternetConnectA InternetOpenA InternetReadFile InternetSetOptionA

kernel32

CloseHandle CompareStringW CopyFileA CreateDirectoryA CreateDirectoryExA CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreatePipe CreateProcessA CreateRemoteThread CreateThread CreateToolhelp32Snapshot CreateWaitableTimerA DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeZoneInformation GetUserDefaultUILanguage GlobalLock GlobalUnlock HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsWow64Process2 K32EnumProcessModulesEx K32EnumProcesses K32GetModuleFileNameExA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile MapViewOfFileEx MoveFileA MoveFileExW MultiByteToWideChar OpenMutexA OpenProcess OutputDebugStringW Process32First Process32Next QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointer SetFilePointerEx SetLastError SetPriorityClass SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SignalObjectAndWait Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

664KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

26.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

25B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

472KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bc27efb01da7f34c3bfcae1e7db1b4d24a37e8d67c7565d41142696430369ff7

advapi32

dinput8

ws2_32

version

user32

ntdll

oleaut32

ole32

comctl32

shell32

dbghelp

tdh

gdi32

iphlpapi

wininet

kernel32

generic