3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10

Sharing

Copy URL Twitter E-mail

General

Target
3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10
Size 1.3MB
Sample260715-ath2jaay71
SHA256 3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10
MD5 211c6471b3a12c1a6eabad0d14dbdf37
SHA1 034afb7b899760bea19547a7c0f41ebf1db952e5
SHA512 08d83e74ea1290f5e2910ccfeaab33f0e1da7b929f1c218cf81b225e0078ba07c33fdf831020de8fef9aa6f9b0b45fde8753b24b0e7dcdeb358d56d99b7a248e
SSDEEP 6144:u+dKcUsP9ex8WFgSYnFtPilWGoQ2W3AcGlJMj1F7lpclj+dW0E6pORMdorld3mxm:Ma1WWKqyQMhpc1+BE6pOGasVjANp
TLSH
T1FE55B438A7E9C452F5B287385AB6C3263E3ABD905779CA0FD700774C1D73A90EA61352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10

File Explorer

3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10

.dll 1.3MB

3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10

IMPHASH f7b74d33de242b48df71b51e36723f62
SHA256 3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10
MD5 211c6471b3a12c1a6eabad0d14dbdf37
SHA1 034afb7b899760bea19547a7c0f41ebf1db952e5
SHA512 08d83e74ea1290f5e2910ccfeaab33f0e1da7b929f1c218cf81b225e0078ba07c33fdf831020de8fef9aa6f9b0b45fde8753b24b0e7dcdeb358d56d99b7a248e
SSDEEP 6144:u+dKcUsP9ex8WFgSYnFtPilWGoQ2W3AcGlJMj1F7lpclj+dW0E6pORMdorld3mxm:Ma1WWKqyQMhpc1+BE6pOGasVjANp
TLSH
T1FE55B438A7E9C452F5B287385AB6C3263E3ABD905779CA0FD700774C1D73A90EA61352
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

223216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyW RegGetValueW RegOpenKeyA RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

CreateUpDownControl ImageList_Create ImageList_Destroy ImageList_Draw ImageList_GetIconSize ImageList_LoadImageW ImageList_ReplaceIcon InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDCW CreateFontIndirectW CreateICA CreateICW CreatePen CreateRectRgnIndirect CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExW ExtTextOutW GdiConvertToDevmodeW GetDeviceCaps GetNearestColor GetObjectW GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MoveToEx Polygon Rectangle SelectClipRgn SelectObject SetBkColor SetBkMode SetTextColor TextOutW

kernel32

ActivateActCtx CreateActCtxW DeactivateActCtx DelayLoadFailureHook DisableThreadLibraryCalls EnumResourceNamesW ExpandEnvironmentStringsW FindClose FindFirstFileW FindResourceA FindResourceW FormatMessageW GetCurrentActCtx GetCurrentDirectoryA GetCurrentDirectoryW GetDriveTypeA GetEnvironmentVariableW GetFileAttributesW GetFullPathNameW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetVersionExW GlobalAlloc GlobalFlags GlobalFree GlobalLock GlobalReAlloc GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource LocalFree LockResource MulDiv MultiByteToWideChar RaiseException ReleaseActCtx ResolveDelayLoadedAPI SetCurrentDirectoryW SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue WideCharToMultiByte lstrcmpA lstrcmpW lstrcmpiW

ntdll

RtlCreateUnicodeStringFromAsciiz RtlFreeUnicodeString _vsnprintf

shell32

ord17 ord18 ord21 ord25 ord152 ord153 ord155 ord162 SHCreateItemFromIDList SHCreateShellItemArray SHCreateShellItemArrayFromDataObject SHGetDesktopFolder SHGetFileInfoW SHGetFolderPathW SHGetIDListFromObject SHGetItemFromObject SHGetSpecialFolderLocation SHParseDisplayName

shlwapi

PathAddBackslashW PathCanonicalizeW PathFileExistsW PathFindExtensionA PathFindExtensionW PathFindFileNameA PathFindFileNameW PathFindNextComponentW PathGetDriveNumberW PathIsDirectoryW PathIsRelativeW PathMatchSpecW PathRemoveExtensionW PathSkipRootW StrChrW StrDupW StrRetToBufW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp atoi calloc free fwrite getenv iswdigit malloc memcmp memcpy memmove strcat strchr strcmp strcpy strcspn strlen strrchr toupper wcschr wcspbrk wcsrchr wcstol

user32

AdjustWindowRectEx AppendMenuW BeginDeferWindowPos BeginPaint CallWindowProcA CallWindowProcW CharLowerW CheckDlgButton CheckRadioButton ClientToScreen CreateDialogIndirectParamA CreateDialogIndirectParamW CreatePopupMenu CreateWindowExA CreateWindowExW DefWindowProcW DeferWindowPos DeleteMenu DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamA DialogBoxIndirectParamW DialogBoxParamW DlgDirListComboBoxW DlgDirListW DrawEdge DrawFocusRect DrawIconEx DrawTextW EnableMenuItem EnableWindow EndDeferWindowPos EndDialog EndPaint FillRect GetClassInfoW GetClassLongW GetClientRect GetDC GetDialogBaseUnits GetDlgCtrlID GetDlgItem GetDlgItemInt GetDlgItemTextA GetDlgItemTextW GetFocus GetMenuItemInfoW GetParent GetPropA GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindow GetWindowInfo GetWindowLongW GetWindowRect GetWindowTextA GetWindowTextLengthW GetWindowTextW InsertMenuItemW InvalidateRect IsChild IsDlgButtonChecked IsWindow IsWindowVisible LoadCursorA LoadCursorW LoadIconA LoadIconW LoadImageA LoadImageW LoadStringA LoadStringW MapWindowPoints MessageBoxW MoveWindow PeekMessageW PostMessageA RedrawWindow RegisterClassW RegisterClipboardFormatA RegisterWindowMessageA RegisterWindowMessageW ReleaseCapture ReleaseDC RemovePropA RemovePropW ScreenToClient SendDlgItemMessageA SendDlgItemMessageW SendMessageA SendMessageW SetCapture SetCursor SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetFocus SetMenuInfo SetParent SetPropA SetPropW SetWindowLongW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu UpdateWindow wsprintfW

winspool.drv

GetDefaultPrinterA GetDefaultPrinterW ClosePrinter DeviceCapabilitiesA DeviceCapabilitiesW DocumentPropertiesA DocumentPropertiesW EnumPrintersA EnumPrintersW GetPrinterA GetPrinterDriverA GetPrinterDriverW GetPrinterW OpenPrinterA OpenPrinterW

Name

.text

Size

220KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

789B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

700KB

Virtual Size

696KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3851e205e594409ad88dbd553ad07585f2a445ce5dca5b272035f0a9ed118d10

advapi32

comctl32

gdi32

kernel32

ntdll

shell32

shlwapi

ucrtbase

user32

winspool.drv

generic