d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687

Sharing

Copy URL Twitter E-mail

General

Target
d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687
Size 3.0MB
Sample260713-ja96caft7x
SHA256 d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687
MD5 524dd587cf0fa9f145fd8c336fdeae94
SHA1 0f278e86edd57b31044a4c432fdb2b10c7e0c563
SHA512 e730027f7bfa7361145ff8293ac11c89b612d4ecb61bcbfa732f360fefa879b256dbf825ac36adfefb8c62f5b71c211a4e0cf56bbb31d7e74ba8ac638558227a
SSDEEP 49152:ROvjlnNpLXxJ4riy/AqWawejk/WPB0Yf+LK/Z16Ll:ROv57xqJANeA/+0bL
TLSH
T13BE5BF42FE8240F2E9934135567B5B7A4D3AB6201338C5C3D3D51D668C626E1AE3F3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687

File Explorer

d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687

.exe 3.0MB

d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687

IMPHASH bb0c86ff88c758cf23bf4efdb3b676c4
SHA256 d2d7e8c369a73b217460e3623176e93a631b5a4d2d76d84282fa9386752a4687
MD5 524dd587cf0fa9f145fd8c336fdeae94
SHA1 0f278e86edd57b31044a4c432fdb2b10c7e0c563
SHA512 e730027f7bfa7361145ff8293ac11c89b612d4ecb61bcbfa732f360fefa879b256dbf825ac36adfefb8c62f5b71c211a4e0cf56bbb31d7e74ba8ac638558227a
SSDEEP 49152:ROvjlnNpLXxJ4riy/AqWawejk/WPB0Yf+LK/Z16Ll:ROv57xqJANeA/+0bL
TLSH
T13BE5BF42FE8240F2E9934135567B5B7A4D3AB6201338C5C3D3D51D668C626E1AE3F3EA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

972719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\WorkSpace\Setup\out\Release\Install.pdb

kernel32

ConvertFiberToThread FindFirstFileW CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation SetConsoleCtrlHandler GetFullPathNameW SetEndOfFile SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapReAlloc HeapFree HeapAlloc GetConsoleCP ReadConsoleW LoadLibraryA SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetFileAttributesExW LoadLibraryExW RtlUnwind OutputDebugStringW InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetModuleHandleW LoadLibraryW GetProcAddress FreeLibrary DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection QueryPerformanceCounter GetTickCount FormatMessageW SetLastError GetLastError FindResourceW LoadResource LockResource lstrcpyW InterlockedDecrement InterlockedIncrement lstrcpynW lstrcmpiW GetLocalTime GlobalAlloc FreeResource MulDiv OpenProcess InitializeCriticalSectionAndSpinCount RaiseException DecodePointer LocalFree GetFileAttributesW CreateDirectoryW LocalFileTimeToFileTime SystemTimeToFileTime SetFileTime SetFilePointer WriteFile ExitProcess GetACP CreateFileW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameW lstrlenW GetFileSize GlobalUnlock GlobalLock VerifyVersionInfoW GetModuleHandleA VerSetConditionMask SleepEx PeekNamedPipe GetFileType WaitForMultipleObjects GetCurrentProcessId GetEnvironmentVariableA Sleep MultiByteToWideChar WideCharToMultiByte MoveFileExW ConvertThreadToFiber ReadFile GetConsoleMode GetStdHandle SizeofResource WaitForSingleObject CloseHandle GetSystemTimeAsFileTime CompareFileTime

user32

GetWindowRect PostQuitMessage GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW CreateWindowExW IsWindow DestroyWindow IsWindowVisible IsIconic IsZoomed GetUserObjectInformationW GetProcessWindowStation CharNextW SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos ScreenToClient MapWindowPoints GetSysColor IntersectRect UnionRect OffsetRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetWindow LoadImageW MonitorFromWindow SetWindowPos wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW ShowWindow EnableWindow GetSystemMetrics GetMenu SetPropW GetPropW AdjustWindowRectEx LoadCursorW SetCursor InflateRect SetWindowRgn MessageBoxW UpdateLayeredWindow MoveWindow IsWindowEnabled GetWindowRgn MonitorFromPoint CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen UpdateWindow EqualRect SetWindowTextW GetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW SystemParametersInfoW GetMonitorInfoW

gdi32

BitBlt CreateCompatibleBitmap SetBitmapBits GetBitmapBits GetTextExtentPointA CreatePatternBrush GdiFlush TextOutW MoveToEx GetObjectA SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateDIBSection PtInRegion CreateRectRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW CloseEnhMetaFile SelectObject SaveDC RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject GetDeviceCaps DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC

advapi32

RegisterEventSourceW CryptReleaseContext CryptGenRandom DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW CryptAcquireContextW

shell32

DragQueryFileW

ole32

CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData DoDragDrop CoInitialize CoCreateInstance RegisterDragDrop RevokeDragDrop CLSIDFromProgID OleLockRunning CLSIDFromString

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

comctl32

ord17 _TrackMouseEvent InitCommonControlsEx

gdiplus

GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLine ord1 GdipRotateWorldTransform GdipTranslateWorldTransform GdipDrawImageI GdipDrawLine GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipSetPenEndCap GdipSetPenStartCap GdipCreatePen2 GdipDrawImageRectI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipSetStringFormatHotkeyPrefix GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectRect GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipResetWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipReleaseDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetPenDashStyle GdipSetPenMode GdipDeletePen GdipCreatePen1 GdipCreateMatrix GdipDeleteBrush GdipCloneBrush GdipRotateMatrix GdipTranslateMatrix GdipDeleteMatrix GdipCreateSolidFill

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

ws2_32

gethostname ioctlsocket gethostbyname select send WSACloseEvent WSACreateEvent getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind accept getsockopt __WSAFDIsSet WSAIoctl setsockopt socket htons WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAEventSelect WSAEnumNetworkEvents

wldap32

ord301 ord147 ord133 ord79 ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142

crypt32

CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertFindCertificateInStore CertDuplicateCertificateContext CertOpenStore

generic

count=23, id=241, version=40116,

count=186, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=71, id=261, version=26706,

count=35, id=260, version=26706,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=54, id=261, version=27054,

count=21, productName=Unmarked objects (old),

count=678, id=260, version=27054,

count=484, id=1, productName=Unmarked objects,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,