49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9

Sharing

Copy URL Twitter E-mail

General

Target
49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9
Size 14.3MB
Sample260716-d3fvbafx2t
SHA256 49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9
MD5 89946d0f7fcfdd188334f74b5ec9133a
SHA1 048094628768029489867b2e669a0a6ae0bb5230
SHA512 1a524f9ec4fb8716840a1255534b30088ac25eb7ba8a2dfd0e4e58b670278020d835a003fb2122f3e443fc126fc2c2256032d08b3cd8582607e4d6bbbbdd907e
SSDEEP 393216:yptK69JwYjEb9fN4fXuYlKeEX6vlgCsdQ6NJH:yptFJ9Qb9fN4f+YlO8lEG6f
TLSH
T1B3E6F1107E874451D021257A1D6CBAF4C1267EA3AAED3C9796E07F0CAAF1BD14D3723A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9

File Explorer

49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9

.exe 14.3MB

49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9

IMPHASH 148d5f82982f07c804e38c74d4b75a00
SHA256 49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9
MD5 89946d0f7fcfdd188334f74b5ec9133a
SHA1 048094628768029489867b2e669a0a6ae0bb5230
SHA512 1a524f9ec4fb8716840a1255534b30088ac25eb7ba8a2dfd0e4e58b670278020d835a003fb2122f3e443fc126fc2c2256032d08b3cd8582607e4d6bbbbdd907e
SSDEEP 393216:yptK69JwYjEb9fN4fXuYlKeEX6vlgCsdQ6NJH:yptFJ9Qb9fN4f+YlO8lEG6f
TLSH
T1B3E6F1107E874451D021257A1D6CBAF4C1267EA3AAED3C9796E07F0CAAF1BD14D3723A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

851147

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\work\kv_svn\Presenter-Windows\branches\PresenterC\Bin\Release\NorwiiPresenter.pdb

hiddevice

SetPathKeyword UsbDeviceChange GetConnectDevices GetSpecialInfo CloseDevicePath InitHidDevice GetDeviceInfoEx SendHidCommand OpenDevicePath EnumeratePaths hid_read_timeout hid_open_path hid_write hid_close

libcurl

curl_formadd curl_slist_free_all curl_easy_getinfo curl_easy_setopt curl_formfree curl_global_init curl_easy_cleanup curl_easy_init curl_easy_strerror curl_slist_append curl_easy_perform curl_global_cleanup

kernel32

RemoveDirectoryW FindClose GetFileAttributesW DeleteFileW CreateEventW SetEvent ResetEvent WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW FlushFileBuffers ReadConsoleW HeapReAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale HeapFree HeapAlloc FindFirstFileW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW RaiseException RtlUnwind InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread SetLastError GetCPInfo DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TerminateThread FindNextFileW InitializeCriticalSectionAndSpinCount InterlockedDecrement InterlockedIncrement CreateMutexW WaitForSingleObject ReleaseMutex CloseHandle lstrlenW Sleep WriteFile CreateFileW GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetTickCount OutputDebugStringA OutputDebugStringW GetLocalTime GetLastError SizeofResource GetCurrentProcess TerminateProcess GetModuleFileNameW GetUserDefaultUILanguage GetEnvironmentVariableW OpenProcess CreateToolhelp32Snapshot Process32NextW FileTimeToSystemTime Process32FirstW LoadResource FindResourceW SystemTimeToFileTime GetTickCount64 CreateProcessW GetModuleHandleW lstrcpyW LoadLibraryW GetProcAddress FreeLibrary CreateFileA CancelIoEx GetCurrentThreadId GetCurrentProcessId SetUnhandledExceptionFilter GetCurrentDirectoryW GetACP MultiByteToWideChar FreeResource LockResource ExitProcess GetFileSize WideCharToMultiByte CreateDirectoryW DosDateTimeToFileTime DuplicateHandle SetFileTime SetFilePointer GetFileType GetVersionExW MulDiv ReadFile SetEndOfFile

user32

GetPropW SetPropW GetMenu EnableWindow GetClassInfoExW OffsetRect SetCursor wvsprintfW GetWindow IsRectEmpty UnionRect IntersectRect MapWindowPoints GetUpdateRect ReleaseCapture SetCapture AdjustWindowRectEx SetFocus IsZoomed IsIconic IsWindowVisible DispatchMessageW TranslateMessage GetMessageW PtInRect CallNextHookEx GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW CreatePopupMenu GetSysColor SystemParametersInfoW GetClientRect SetWindowLongW MonitorFromWindow CharPrevW SetRect MonitorFromPoint SetWindowTextW GetActiveWindow wsprintfW SendMessageW SetWindowPos PostMessageW GetWindowLongW SetForegroundWindow UpdateWindow LoadCursorW GetForegroundWindow CreateAcceleratorTableW InvalidateRgn GetCaretBlinkTime MsgWaitForMultipleObjects GetCaretPos RegisterClassW ShowWindow CreateWindowExW GetDC DestroyWindow DefWindowProcW GetWindowTextW EndPaint BeginPaint InvalidateRect DrawTextW TrackMouseEvent GetSystemMetrics FillRect CallWindowProcW CharNextW KillTimer GetCursorPos SetCursorPos mouse_event keybd_event GetKeyState SetTimer ReleaseDC GetDesktopWindow SetClipboardData EmptyClipboard CloseClipboard OpenClipboard EnumDisplaySettingsW EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors FindWindowW IsWindow GetWindowRect FindWindowExW SetLayeredWindowAttributes ScreenToClient ClientToScreen GetParent GetFocus MessageBoxW CreateCaret UpdateLayeredWindow MoveWindow CreateDialogParamW GetDlgItem SetClassLongW DestroyCursor SetWindowRgn RegisterClassExW PostQuitMessage AppendMenuW LoadIconW RegisterDeviceNotificationW TrackPopupMenu GetWindowTextLengthW HideCaret ShowCaret GetGUIThreadInfo SetCaretPos

gdi32

GetDeviceCaps CreateDCW CreateDIBSection CreateFontIndirectW GetObjectW CreateFontW GetTextExtentPoint32W SetBkMode SetBkColor DeleteObject CreateSolidBrush GetObjectA BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC GetStockObject GetDIBits SetTextColor CreatePatternBrush GdiFlush ExtTextOutW TextOutW MoveToEx SetStretchBltMode StretchBlt ExtSelectClipRgn SelectClipRgn RoundRect LineTo GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CreatePenIndirect CombineRgn CreateRoundRectRgn SetWindowOrgEx GetTextMetricsW SaveDC RestoreDC Rectangle CreatePen GetPixel Ellipse DeleteDC

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW RegQueryValueExW RegDeleteValueW RegGetValueW RegOpenKeyExW RegSetValueExW RegCloseKey

shell32

ShellExecuteExW Shell_NotifyIconW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW CommandLineToArgvW

ole32

CoUninitialize CoCreateGuid CoInitialize CLSIDFromString OleLockRunning CreateStreamOnHGlobal CoCreateInstance CLSIDFromProgID

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdiplus

GdipDrawImage GdipGraphicsClear GdipCreateLineBrushI GdipLoadImageFromStream GdipDeleteFontFamily GdipDeleteFont GdipSetCompositingMode GdipDeleteStringFormat GdipDeleteGraphics GdipCloneBrush GdipGetImageWidth GdipGetFamily GdipDrawImageRectRectI GdipSetStringFormatAlign GdipLoadImageFromStreamICM GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipLoadImageFromFile GdipSetTextRenderingHint GdipFillEllipseI GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdipImageSelectActiveFrame GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetPropertyItemSize GdipSetClipPath GdipSetPenDashStyle GdipCreateBitmapFromHBITMAP GdipDrawLineI GdipStartPathFigure GdipCloneImage GdipAddPathEllipseI GdipDrawEllipseI GdipDisposeImage GdipFillPath GdipGetSmoothingMode GdipCreateTexture GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipAddPathArcI GdipDeletePath GdipCreatePath GdipAddPathLineI GdipDrawPath GdipDeletePen GdipCreatePen1 GdipCreateStringFormat GdipGetImageHeight GdipSetCompositingQuality GdipCreateFontFromLogfontA GdipDeleteBrush GdipAlloc GdipDrawImageRectI GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipSetInterpolationMode GdipCreateSolidFill GdipSetPixelOffsetMode GdipCreateFontFromDC GdipFree GdipDrawString GdipCreateFromHDC GdipClosePathFigure

winmm

mciSendStringW

setupapi

SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA

hid

HidD_FreePreparsedData HidD_GetPreparsedData HidP_GetCaps HidD_SetOutputReport HidD_GetInputReport

imm32

ImmSetCompositionWindow ImmSetCompositionFontW ImmGetContext ImmReleaseContext

comctl32

_TrackMouseEvent ord17

Sharing

General

Malware Config

Signatures

File Explorer

49bf1e685bb15fa209a1a6f7a224bc2ed436980503b0b1d63795273380f91af9

hiddevice

libcurl

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

gdiplus

winmm

setupapi

hid

imm32

comctl32

generic