c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01

Sharing

Copy URL Twitter E-mail

General

Target
c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01
Size 655KB
Sample260716-e7sv4sds3q
SHA256 c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01
MD5 e05aca088f422e7e699861319094ce1c
SHA1 a653f9028fe11f8b2f70c488848f27818a7336f9
SHA512 83b969cbb74e8e2c7d608d499c48e54ad8c1634fa635eb4cf0ae19696a4b0525c89858f1f39df2c56bb1c8a3240bd221e7874b72ae2d2542981a9104fea3be47
SSDEEP 12288:FibHl+cDph60PdcQCdLiPJve6rMWnHBPZG/3JsCGYUbvph0lhSMXlCz5RrutcR:FibF+cth0vJsCGYU1h0lhSMXlw5wtc
TLSH
T154E4BE51B643C07AE24D01F2356CAFBA5A3DAD310BA515CBB7C06E7A5D701C26B39B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01

File Explorer

c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01

.dll 655KB

c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01

IMPHASH 2fd19972df8da1af78ed25d3eb54ae81
SHA256 c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01
MD5 e05aca088f422e7e699861319094ce1c
SHA1 a653f9028fe11f8b2f70c488848f27818a7336f9
SHA512 83b969cbb74e8e2c7d608d499c48e54ad8c1634fa635eb4cf0ae19696a4b0525c89858f1f39df2c56bb1c8a3240bd221e7874b72ae2d2542981a9104fea3be47
SSDEEP 12288:FibHl+cDph60PdcQCdLiPJve6rMWnHBPZG/3JsCGYUbvph0lhSMXlCz5RrutcR:FibF+cth0vJsCGYU1h0lhSMXlw5wtc
TLSH
T154E4BE51B643C07AE24D01F2356CAFBA5A3DAD310BA515CBB7C06E7A5D701C26B39B0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

299166

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\git\usb\Release\usb.pdb

kernel32

CreateDirectoryA WideCharToMultiByte FreeLibrary GetProcessHeap GetProcAddress GetOverlappedResult GetLocalTime HeapAlloc ResetEvent LoadLibraryW WriteConsoleW SetEndOfFile HeapSize ReadConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CloseHandle IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileSizeEx HeapReAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GlobalFree GlobalAlloc SetEvent GetLastError GetTickCount64 Sleep MultiByteToWideChar CreateEventW CreateFileW WaitForSingleObject WaitForMultipleObjects GetModuleFileNameW DeviceIoControl WriteFile VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree CancelIo ExitProcess FreeLibraryAndExitThread GetModuleFileNameA GetACP CreateFileA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseMutex CreateMutexA GetVersionExA GetCurrentProcess RaiseException GetCurrentThreadId IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW GetCPInfoExW QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LCMapStringEx CompareStringEx InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwind InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread ReadFile

user32

wsprintfW MessageBoxW BroadcastSystemMessageW

advapi32

RegQueryValueExW RegOpenKeyExW RegSetValueExW RegDeleteKeyValueW RegCloseKey

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces CM_Enable_DevNode CM_Get_Sibling SetupDiSetClassInstallParamsW CM_Get_DevNode_Registry_PropertyW CM_Get_Device_Interface_ListW CM_Get_Device_IDW CM_Get_Child SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceInterfaceDetailW SetupDiGetClassDevsW SetupDiRemoveDevice CM_Get_Parent SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW CM_Disable_DevNode

hid

HidD_SetFeature HidD_SetOutputReport HidD_GetFeature HidD_GetSerialNumberString HidD_GetPreparsedData HidD_FreePreparsedData HidP_GetCaps HidD_GetManufacturerString HidD_GetAttributes HidD_GetProductString HidP_GetButtonCaps HidD_GetInputReport HidP_GetValueCaps

winusb

WinUsb_ControlTransfer WinUsb_Initialize WinUsb_Free

shlwapi

PathRemoveFileSpecA PathFileExistsA

cfgmgr32

CM_Get_DevNode_PropertyW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

iphlpapi

GetAdaptersInfo

Name

.text

Size

422KB

Virtual Size

422KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

shared

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c3f38ab59339432b9057b009ec22ebfa064f8aa4f8224be2e854a5bdd1663b01

kernel32

user32

advapi32

setupapi

hid

winusb

shlwapi

cfgmgr32

version

iphlpapi

generic