8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289

Sharing

Copy URL Twitter E-mail

General

Target
8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289
Size 7.1MB
Sample260714-e33vhses8p
SHA256 8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289
MD5 b90f668d8cae1adc040fae3f91daca43
SHA1 9c134c1642773c79c3d94e4d62bafbffab09e713
SHA512 12f00527339863d830916aded42b74f8a511a7802b7047d74a2399df598d511c0566feeb3ea03a9d01957b7c398a10d138bd9e5c8ac526ed73b6eee989089710
SSDEEP 98304:hyRxoOZlCCLTMOUEdoGcf1sDwQMSYwrY+:hyRx2+hxcf2wQMf1+
TLSH
T1A2764B017A0F68AEC59ACCB4D38B49631D2430CF16B2BCBF86C595363F5E6785B36219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289

File Explorer

8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289

.exe 7.1MB

8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289

IMPHASH 45b55fcb8a3cef855ab64a55fcbaec2f
SHA256 8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289
MD5 b90f668d8cae1adc040fae3f91daca43
SHA1 9c134c1642773c79c3d94e4d62bafbffab09e713
SHA512 12f00527339863d830916aded42b74f8a511a7802b7047d74a2399df598d511c0566feeb3ea03a9d01957b7c398a10d138bd9e5c8ac526ed73b6eee989089710
SSDEEP 98304:hyRxoOZlCCLTMOUEdoGcf1sDwQMSYwrY+:hyRx2+hxcf2wQMf1+
TLSH
T1A2764B017A0F68AEC59ACCB4D38B49631D2430CF16B2BCBF86C595363F5E6785B36219
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3613816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

AdjustWindowRectEx BeginPaint CallNextHookEx ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW DrawIconEx DrawTextW EmptyClipboard EnableWindow EndPaint FillRect FindWindowW GetClassNameW GetClientRect GetCursorPos GetDpiForSystem GetDpiForWindow GetMessageW GetSystemMetrics GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsDialogMessageW IsIconic IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW LoadImageW MessageBeep MessageBoxW MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostMessageW PostQuitMessage PtInRect RegisterClassExW ReleaseCapture SendMessageW SetActiveWindow SetCapture SetClipboardData SetFocus SetForegroundWindow SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnhookWindowsHookEx UpdateWindow

gdi32

CreateFontW CreatePen CreateSolidBrush DeleteObject GetStockObject LineTo MoveToEx Rectangle SelectObject SetBkColor SetBkMode SetTextColor

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoUninitialize OleInitialize OleUninitialize StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantChangeType VariantClear VariantInit

shell32

SHCreateItemFromParsingName SHGetKnownFolderPath ShellExecuteW

shlwapi

PathRemoveFileSpecW UrlCreateFromPathW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpQueryOption WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

ws2_32

bind closesocket getsockname htonl ntohs socket

advapi32

EventRegister EventSetInformation EventUnregister EventWriteTransfer RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty BCryptSignHash

cabinet

ord45 ord40 ord43

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateChain CertFreeCertificateContext CertGetCertificateChain CertGetNameStringW CertOpenStore CryptBinaryToStringA CryptEncodeObject CryptProtectData CryptStringToBinaryA CryptUnprotectData

kernel32

AcquireSRWLockExclusive AreFileApisANSI CheckRemoteDebuggerPresent CloseHandle CloseThreadpoolWork CompareStringW CopyFileW CreateDirectoryW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateThread CreateThreadpoolWork CreateTimerQueue CreateTimerQueueTimer CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteTimerQueueEx DeleteTimerQueueTimer EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetTickCount GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource Module32FirstW Module32NextW MoveFileExW MulDiv MultiByteToWideChar OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SubmitThreadpoolWork TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

936KB

Virtual Size

936KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8465c9409b995b56db149e980ef39988d2f17970d8e542c1bc07b84f49f23289

user32

gdi32

ole32

oleaut32

shell32

shlwapi

comctl32

version

winhttp

ws2_32

advapi32

bcrypt

cabinet

crypt32

kernel32

generic