712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e

Sharing

Copy URL Twitter E-mail

General

Target
712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e
Size 3.0MB
Sample260714-e5w5raet3r
SHA256 712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e
MD5 d7e1727ddf921f949a5811d17188b1e6
SHA1 131bba7848e96d07c3bd374df2382696fd8c3e1f
SHA512 351312482dbf11295dff8ab94554632bb31572909f361360dd5e81ca9bcdd058485f30770b0278b5d85b488b4e75dc748bee66d950877227642a17477a139de9
SSDEEP 49152:m+v/dUgzniWO8mXgi1Rbg5I+WPLR/Ubn7wfJUpdB:m+v5VmQ0gO+kRun
TLSH
T1A9E5BF12FF8280B2E992423556BF6B3A4D3AA6205334C5C393D51D668C625E19F3F3F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e

File Explorer

712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e

.exe 3.0MB

712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e

IMPHASH 1fd69171a53ec216572703fb42430c06
SHA256 712f6506519fab0aca50e8acd4aea02fc17ae90a53cdd42ab0b2415bba18bf0e
MD5 d7e1727ddf921f949a5811d17188b1e6
SHA1 131bba7848e96d07c3bd374df2382696fd8c3e1f
SHA512 351312482dbf11295dff8ab94554632bb31572909f361360dd5e81ca9bcdd058485f30770b0278b5d85b488b4e75dc748bee66d950877227642a17477a139de9
SSDEEP 49152:m+v/dUgzniWO8mXgi1Rbg5I+WPLR/Ubn7wfJUpdB:m+v5VmQ0gO+kRun
TLSH
T1A9E5BF12FF8280B2E992423556BF6B3A4D3AA6205334C5C393D51D668C625E19F3F3F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

964059

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileW CreateFiber DeleteFiber SwitchToFiber ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetSystemTime HeapSize WriteConsoleW DeleteFileW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation SetConsoleCtrlHandler GetFullPathNameW SetEndOfFile SetStdHandle FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapReAlloc HeapFree HeapAlloc GetConsoleCP ReadConsoleW GetConsoleMode ConvertThreadToFiber SetFilePointerEx GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetFileAttributesExW LoadLibraryExW RtlUnwind OutputDebugStringW InitializeSListHead GetCurrentThreadId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread LoadLibraryA WideCharToMultiByte MultiByteToWideChar Sleep GetModuleHandleW LoadLibraryW GetProcAddress FreeLibrary DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection QueryPerformanceFrequency QueryPerformanceCounter FormatMessageW SetLastError lstrcpyW InterlockedDecrement InterlockedIncrement lstrcpynW lstrcmpiW GetLocalTime GlobalAlloc FindResourceW SizeofResource LoadResource LockResource FreeResource MulDiv OpenProcess InitializeCriticalSectionAndSpinCount RaiseException DecodePointer LocalFree GetFileAttributesW CreateDirectoryW LocalFileTimeToFileTime SystemTimeToFileTime SetFileTime SetFilePointer WriteFile ExitProcess GetACP CreateFileW GetCurrentDirectoryW SetCurrentDirectoryW GetModuleFileNameW lstrlenW GetFileSize GlobalUnlock VerSetConditionMask SleepEx PeekNamedPipe ReadFile GlobalLock MoveFileExW WaitForSingleObject CloseHandle GetSystemTimeAsFileTime CompareFileTime GetEnvironmentVariableA ConvertFiberToThread VerifyVersionInfoW GetModuleHandleA GetLastError GetCurrentProcessId WaitForMultipleObjects GetFileType GetStdHandle

user32

GetWindowRect PostQuitMessage GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW CreateWindowExW IsWindow DestroyWindow IsWindowVisible IsIconic IsZoomed GetUserObjectInformationW GetProcessWindowStation CharNextW SetFocus GetActiveWindow GetFocus GetKeyState SetCapture ReleaseCapture SetTimer KillTimer GetDC ReleaseDC BeginPaint EndPaint GetUpdateRect InvalidateRect GetClientRect GetCursorPos ScreenToClient MapWindowPoints GetSysColor IntersectRect UnionRect OffsetRect IsRectEmpty PtInRect GetWindowLongW SetWindowLongW GetParent GetWindow LoadImageW MonitorFromWindow SetWindowPos wsprintfW DefWindowProcW CallWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW ShowWindow EnableWindow GetSystemMetrics GetMenu SetPropW GetPropW AdjustWindowRectEx LoadCursorW SetCursor InflateRect SetWindowRgn MessageBoxW UpdateLayeredWindow MoveWindow IsWindowEnabled GetWindowRgn MonitorFromPoint CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen UpdateWindow EqualRect SetWindowTextW GetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW SystemParametersInfoW GetMonitorInfoW

gdi32

CreateCompatibleBitmap CreateDIBSection CreateCompatibleDC SetBitmapBits GetBitmapBits GetTextExtentPointA CreatePatternBrush GdiFlush TextOutW MoveToEx GetObjectA SetTextColor SetStretchBltMode StretchBlt SetBkMode SetBkColor ExtSelectClipRgn SelectClipRgn LineTo GetTextExtentPoint32W GetClipBox GetCharABCWidthsW CreateSolidBrush CreateRectRgnIndirect CreatePenIndirect CombineRgn BitBlt PtInRegion CreateRectRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW CloseEnhMetaFile SelectObject SaveDC RestoreDC Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetStockObject GetDeviceCaps DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap

advapi32

RegisterEventSourceW CryptReleaseContext CryptGenRandom DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW CryptAcquireContextW

shell32

DragQueryFileW

ole32

CLSIDFromString CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData CoInitialize CoCreateInstance RegisterDragDrop RevokeDragDrop DoDragDrop OleLockRunning CLSIDFromProgID

oleaut32

SysFreeString SysAllocString VariantClear VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

gdiplus

GdiplusShutdown GdiplusStartup GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLine ord1 GdipCreateMatrix GdipRotateWorldTransform GdipTranslateWorldTransform GdipDrawImageI GdipDrawLine GdipCreateBitmapFromScan0 GdipGetImageGraphicsContext GdipSetPenEndCap GdipSetPenStartCap GdipCreatePen2 GdipDrawImageRectI GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipGetImageWidth GdipSetStringFormatHotkeyPrefix GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipCloneStringFormat GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipMeasureString GdipDrawString GdipDeleteFont GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipDrawImageRectRect GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipResetWorldTransform GdipSetWorldTransform GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetSmoothingMode GdipReleaseDC GdipDeleteGraphics GdipCreateFromHDC GdipSetImageAttributesColorMatrix GdipDisposeImageAttributes GdipCreateImageAttributes GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdipSetPenDashStyle GdipSetPenMode GdipDeletePen GdipDeleteMatrix GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipRotateMatrix GdipTranslateMatrix GdipCreatePen1

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

ws2_32

gethostname gethostbyname accept send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents ioctlsocket getpeername sendto recvfrom freeaddrinfo getaddrinfo recv listen htonl getsockname connect bind getsockopt select __WSAFDIsSet WSAIoctl setsockopt socket htons WSACleanup WSAStartup WSASetLastError ntohs WSAGetLastError closesocket WSAEventSelect

wldap32

ord301 ord147 ord133 ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79

crypt32

CertFreeCertificateContext CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreW CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertOpenStore

generic

count=23, id=241, version=40116,

count=186, id=243, version=40116,

count=30, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=6, id=199, version=41118,

count=26, id=259, version=26706,

count=71, id=261, version=26706,

count=35, id=260, version=26706,

count=16, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=54, id=261, version=27054,

count=21, productName=Unmarked objects (old),

count=678, id=260, version=27054,

count=484, id=1, productName=Unmarked objects,

count=27, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=4, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,