31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c

Sharing

Copy URL Twitter E-mail

General

Target
31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c
Size 501KB
Sample260715-ar3cdsay5x
SHA256 31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c
MD5 32fa29da7fa7fb5eddadb9edf1764fe1
SHA1 984816253f45dc60aed8fa70227b70932594943a
SHA512 5aa004718e223f2eec1daef447735b260136b2de52e39bba7cc9668045848e8b620448828d89277f16426fa642f4993aab37ca5e2a3b3c2646264d0de8e19e64
SSDEEP 3072:cpaK7AABzGmAFXJ1BGXGSpYDGO2zop8W/RN1BzEEv3eavAXwSIkqdju1jlOSP59N:saKfMDGXAz2kpP154CYjdyzXXnUQQ
TLSH
T10CB4A72177F49516F6F39B386DF5D2512ABABE41BB36CB0F42001A2D0876B91DD60B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c

File Explorer

31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c

.dll 501KB

31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c

IMPHASH d1011efc32c6f13c6ce4e0831c1dac24
SHA256 31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c
MD5 32fa29da7fa7fb5eddadb9edf1764fe1
SHA1 984816253f45dc60aed8fa70227b70932594943a
SHA512 5aa004718e223f2eec1daef447735b260136b2de52e39bba7cc9668045848e8b620448828d89277f16426fa642f4993aab37ca5e2a3b3c2646264d0de8e19e64
SSDEEP 3072:cpaK7AABzGmAFXJ1BGXGSpYDGO2zop8W/RN1BzEEv3eavAXwSIkqdju1jlOSP59N:saKfMDGXAz2kpP154CYjdyzXXnUQQ
TLSH
T10CB4A72177F49516F6F39B386DF5D2512ABABE41BB36CB0F42001A2D0876B91DD60B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegEnumKeyExW RegGetValueA RegOpenKeyA RegOpenKeyExW RegOpenKeyW RegQueryValueExW

bcrypt

BCryptHash

comctl32

ImageList_Create ImageList_Destroy ImageList_ReplaceIcon InitCommonControlsEx PropertySheetW

comdlg32

GetOpenFileNameW

kernel32

DelayLoadFailureHook GetTickCount HeapReAlloc IsBadStringPtrW ResolveDelayLoadedAPI

kernelbase

CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteFileW GetFileAttributesW GetFileSize GetModuleHandleW GetProcAddress GetSystemDirectoryW HeapAlloc HeapFree LocalFree MapViewOfFile MultiByteToWideChar PathAllocCanonicalize UnmapViewOfFile

ntdll

_vsnprintf wine_get_version

ole32

CoTaskMemAlloc

shell32

ExtractIconExW ShellExecuteExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wgetenv calloc free fwrite getenv malloc memcmp memcpy memmove realloc strchr strcmp strcspn strlen wcschr wcscmp wcslen wcsncmp wcstol

urlmon

CreateAsyncBindCtx CreateURLMoniker

user32

DestroyIcon DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetDlgItem GetSystemMetrics GetWindowTextW LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW SendDlgItemMessageW SendMessageW SetWindowTextW ShowWindow TranslateMessage wsprintfW

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

40KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

135B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

256KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

31337d3409d03d90760ed7533ba6a7d5e3800eccfb81ce0ba2b6c2ccad4ad88c

advapi32

bcrypt

comctl32

comdlg32

kernel32

kernelbase

ntdll

ole32

shell32

ucrtbase

urlmon

user32

generic