712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767

Sharing

Copy URL Twitter E-mail

General

Target
712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767
Size 7.5MB
Sample260717-l2rt7act2s
SHA256 712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767
MD5 32cdd92f735888b443e0e350afb4b7d0
SHA1 bae320494f97adb56c83e8a7ba1ae4839c930f3e
SHA512 60241771518f111f93e3b90f4d57f73544eeb579a60e91f194be088373c789d105f7891127a5ff48f278e0eb4f7916a3d60069aefc34d593885925274514d5f5
SSDEEP 196608:OnjupKGoo8jbJX3eAad6prz/YLu1V5ZV/P:OnjupKPnJX3eAEMrDYLujhn
TLSH
T1CD86BE83B383D2FAC44B81F9294D672E961856188711CADBC3901FFE76F25C309759BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767

File Explorer

712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767

.dll 7.5MB

712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767

IMPHASH 507a1d1cc88e5b9cb56d1c042e942b62
SHA256 712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767
MD5 32cdd92f735888b443e0e350afb4b7d0
SHA1 bae320494f97adb56c83e8a7ba1ae4839c930f3e
SHA512 60241771518f111f93e3b90f4d57f73544eeb579a60e91f194be088373c789d105f7891127a5ff48f278e0eb4f7916a3d60069aefc34d593885925274514d5f5
SSDEEP 196608:OnjupKGoo8jbJX3eAad6prz/YLu1V5ZV/P:OnjupKPnJX3eAEMrDYLujhn
TLSH
T1CD86BE83B383D2FAC44B81F9294D672E961856188711CADBC3901FFE76F25C309759BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1828064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringEx CompareStringW CreateDirectoryA CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateProcessA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemFirmwareTables EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindNextFileA FindNextFileW FlushFileBuffers FlushInstructionCache FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleCP GetConsoleMode GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceA GetDriveTypeA GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFileType GetFullPathNameA GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDrives GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetOverlappedResult GetPrivateProfileIntA GetPrivateProfileSectionA GetPrivateProfileStringA GetProcAddress GetProcessHeap GetProcessTimes GetProfileStringA GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemFirmwareTable GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadId GetTickCount64 GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLocaleName GetUserDefaultUILanguage GetVersion GetVersionExA GetWindowsDirectoryW GlobalFree HeapAlloc HeapCreate HeapFree HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InitializeSRWLock InterlockedFlushSList InterlockedPushEntrySList IsBadReadPtr IsBadStringPtrA IsBadStringPtrW IsBadWritePtr IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcessModules LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalAlloc LocalFree LockFile MapViewOfFile MapViewOfFileEx MultiByteToWideChar OpenEventA OpenFileMappingA OpenMutexA OpenProcess OpenSemaphoreA PeekNamedPipe Process32First Process32Next ProcessIdToSessionId PulseEvent QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore RemoveDirectoryA RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent SetConsoleCtrlHandler SetCurrentDirectoryA SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetLastError SetPriorityClass SetStdHandle SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileSectionA WritePrivateProfileStringA

user32

AppendMenuA CallMsgFilterA CharLowerBuffA CharUpperBuffA DispatchMessageA DrawMenuBar EnumDisplayDevicesA GetSystemMenu GetSystemMetrics LoadStringA MessageBoxA MessageBoxW PeekMessageA TranslateMessage wsprintfA

psapi

GetModuleFileNameExA

powrprof

PowerReadFriendlyName

advapi32

CloseServiceHandle ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CryptAcquireContextA CryptGenRandom CryptReleaseContext GetSecurityDescriptorSacl GetTokenInformation GetUserNameW InitializeSecurityDescriptor IsValidSid OpenProcessToken OpenSCManagerA OpenServiceA QueryServiceConfigA QueryServiceStatus QueryServiceStatusEx RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyExA RegEnumValueA RegFlushKey RegOpenKeyExA RegQueryValueExA RegSetValueExA SetSecurityDescriptorDacl SetSecurityDescriptorSacl StartServiceA

ntdll

NtOpenSymbolicLinkObject RtlAddVectoredExceptionHandler RtlRemoveVectoredExceptionHandler RtlUnwind

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getpeername getsockopt htons inet_addr inet_ntoa ioctlsocket recv recvfrom select send sendto setsockopt shutdown socket

shell32

SHGetFolderPathA SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteExA

ole32

CoTaskMemFree

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringA CertGetNameStringW CryptMsgClose CryptMsgGetParam CryptQueryObject

winhttp

WinHttpCloseHandle WinHttpGetDefaultProxyConfiguration WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

wintrust

WinVerifyTrust

Name

__wibu00

Size

773KB

Virtual Size

772KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

__wibu01

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

__wibu02

Size

13KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

__wibu03

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

__wibu04

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

__wibu05

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

__wibu06

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

__wibu07

Size

494KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

__wibu08

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

__wibu09

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

Name

__wibu0a

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

__wibu0b

Size

1024B

Virtual Size

4KB

Characteristics

Name

__wibu0c

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

__wibu0d

Size

429KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

712e775410047bae7aa19c8936ba67d113df2e97701119ed160a76438ff27767

kernel32

user32

psapi

powrprof

advapi32

ntdll

version

ws2_32

shell32

ole32

crypt32

winhttp

wintrust

generic