1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477

Sharing

Copy URL Twitter E-mail

General

Target
1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477
Size 2.4MB
Sample260718-g4tpcaax2k
SHA256 1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477
MD5 3ec13a48b6cb54d53f92e4e9c4d2bd3d
SHA1 77c036aabc6da4d01add662c55e20c302ac2c8e5
SHA512 c0236ccd53dd36e799636efc658212e165992345a3e1b7d7cbb1020449e1bd2db92a5a18a3fa297d9f6638e0d67895c69ab09a2b2c454e4da5966266ec08963d
SSDEEP 384:vYpXsseDjiHlfpXssernfbELAGTCf6sVMuq/fPpuKIh2CATRIcxzPAxu:+XsseaFxXsserYLZDsKhPpuKC2LbI
TLSH
T186C5099B735981A7C8B50B711C339E8B57E1EE617A264D1739C0B3CF1F9E1C2982A741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477

File Explorer

1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477

.exe 2.4MB

1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477

IMPHASH 9711206b0493908fb322bd63745bfb7a
SHA256 1ead010c0a68960c8e65e9199e281e44cff58392979a91fd2072c525e9bf2477
MD5 3ec13a48b6cb54d53f92e4e9c4d2bd3d
SHA1 77c036aabc6da4d01add662c55e20c302ac2c8e5
SHA512 c0236ccd53dd36e799636efc658212e165992345a3e1b7d7cbb1020449e1bd2db92a5a18a3fa297d9f6638e0d67895c69ab09a2b2c454e4da5966266ec08963d
SSDEEP 384:vYpXsseDjiHlfpXssernfbELAGTCf6sVMuq/fPpuKIh2CATRIcxzPAxu:+XsseaFxXsserYLZDsKhPpuKC2LbI
TLSH
T186C5099B735981A7C8B50B711C339E8B57E1EE617A264D1739C0B3CF1F9E1C2982A741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1537403

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeviceIoControl GetDriveTypeW GetDiskFreeSpaceExW ReadFile lstrlenA GetPrivateProfileStringW GetComputerNameW GetSystemTime ResetEvent GetSystemInfo GetWindowsDirectoryW GetSystemDirectoryW LocalFree GetNativeSystemInfo PostQueuedCompletionStatus GetExitCodeThread CreateIoCompletionPort GetQueuedCompletionStatus GetThreadLocale SetThreadLocale TerminateProcess GetCurrentProcess lstrcmpA GetFileAttributesExW FileTimeToSystemTime SleepEx FormatMessageA GetFileType GetStdHandle PeekNamedPipe ExpandEnvironmentStringsA QueryPerformanceCounter LoadLibraryA GlobalMemoryStatus FlushConsoleInputBuffer WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetCurrentDirectoryW FlushFileBuffers GetTimeZoneInformation SetStdHandle SetFileAttributesW IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleCP ReadConsoleW GetACP SetConsoleMode ReadConsoleInputA GetConsoleMode SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime FindFirstFileExW GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SwitchToThread SignalObjectAndWait CreateTimerQueue GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead IsDebuggerPresent GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc GetStringTypeW GetCurrentThread DuplicateHandle TryEnterCriticalSection MoveFileExW GetPrivateProfileIntW RemoveDirectoryW SetFilePointer SetEndOfFile GetFileTime SystemTimeToFileTime WaitForSingleObjectEx TerminateThread InitializeCriticalSection WriteFile GetVersion GlobalFree GlobalAlloc MulDiv GetModuleHandleA VerifyVersionInfoW VerSetConditionMask WideCharToMultiByte GetVersionExW GetCurrentProcessId GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW lstrlenW GetFullPathNameW LoadLibraryExW lstrcmpiW GetModuleHandleW Process32FirstW Process32NextW Sleep ProcessIdToSessionId CreateToolhelp32Snapshot OpenProcess ReleaseMutex GetUserDefaultLCID CreateMutexW GetTickCount SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects InterlockedCompareExchange InterlockedExchange CopyFileW GetFileSize CreateThread CloseHandle DeleteFileW OutputDebugStringW MultiByteToWideChar GetCurrentThreadId CreateFileW FindClose FindNextFileW SetLastError FindFirstFileW CreateDirectoryW InterlockedIncrement FreeLibrary GetProcessHeap SizeofResource DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW LoadLibraryW RaiseException HeapReAlloc LockResource GetLastError HeapSize LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW InterlockedDecrement EnterCriticalSection HeapFree EnumSystemLocalesW

user32

DestroyWindow CallWindowProcW DefWindowProcW GetWindowLongW GetParent GetDlgItem GetUserObjectInformationW GetProcessWindowStation CharLowerBuffW CreateWindowExW SendMessageW MapWindowPoints GetMonitorInfoW MonitorFromWindow SetWindowPos GetWindowRect GetWindow KillTimer SetTimer RegisterClassExW CharNextW PeekMessageW DispatchMessageW GetMessageW GetAncestor LoadCursorW SetWindowLongW EnumDisplaySettingsW GetDesktopWindow GetForegroundWindow GetWindowInfo WindowFromPoint GetShellWindow MonitorFromPoint GetWindowThreadProcessId GetClientRect SetRectEmpty EqualRect SetCursor ClientToScreen GetCursorPos PtInRect ScreenToClient GetDoubleClickTime IntersectRect PostMessageW GetDC ReleaseDC ShowWindow IsRectEmpty GetIconInfo DrawIconEx SystemParametersInfoW BeginPaint EndPaint IsIconic InvalidateRect TrackMouseEvent GetClassInfoExW FindWindowExW UnregisterClassW IsWindow SetFocus SetForegroundWindow SetCapture ReleaseCapture SetWindowRgn EnableWindow GetWindowTextW PostQuitMessage IsWindowVisible IsZoomed MonitorFromRect OffsetRect SetLayeredWindowAttributes UpdateLayeredWindow SetWindowTextW GetWindowTextLengthW GetFocus DrawTextW FillRect UpdateWindow SetActiveWindow AttachThreadInput BringWindowToTop GetCaretBlinkTime CreateCaret SetCaretPos GetSysColor CopyRect MoveWindow RegisterClipboardFormatW IsClipboardFormatAvailable wsprintfW MessageBoxA TranslateMessage

gdi32

SetTextCharacterExtra GetCurrentObject GetTextColor CreateFontIndirectW Rectangle CreatePen CreateSolidBrush SetBkMode SetBkColor SetTextColor CreateRectRgn CombineRgn CreateRoundRectRgn SaveDC GetBitmapBits StretchBlt SetStretchBltMode DeleteDC BitBlt SetPixel SelectObject CreateCompatibleDC GetObjectW DeleteObject CreateDIBSection GetStockObject GetDeviceCaps CreateRectRgnIndirect ExtSelectClipRgn RestoreDC GetViewportOrgEx SetBitmapBits

advapi32

DeregisterEventSource FreeSid CheckTokenMembership AllocateAndInitializeSid ConvertSidToStringSidW LookupAccountNameW RegSetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExW LookupPrivilegeValueW RegCloseKey RegQueryInfoKeyW QueryServiceStatus CloseServiceHandle OpenSCManagerW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW OpenProcessToken StartServiceW RegOpenKeyExW CreateProcessAsUserW RegDeleteValueW OpenServiceW DuplicateTokenEx GetTokenInformation ReportEventA RegisterEventSourceA

shell32

SHGetSpecialFolderPathA ShellExecuteW ord165 SHGetSpecialFolderPathW SHCreateDirectoryExW SHChangeNotify

ole32

RegisterDragDrop StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

SysAllocStringLen SysAllocString VarUI4FromStr LoadRegTypeLi LoadTypeLi SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VariantTimeToSystemTime SystemTimeToVariantTime VarDateFromStr VarBstrCmp

shlwapi

StrStrIW SHDeleteKeyW PathSearchAndQualifyW AssocQueryStringW StrCmpIW PathFileExistsW PathRemoveFileSpecW PathAppendW PathIsDirectoryW PathCombineW SHGetValueW PathFindFileNameW PathIsRootW SHDeleteValueW SHSetValueW

comctl32

ord17 InitCommonControlsEx

msimg32

AlphaBlend

wininet

InternetConnectW HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetSetOptionW InternetOpenW InternetCrackUrlW HttpQueryInfoW InternetReadFile

setupapi

SetupIterateCabinetW

gdiplus

GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipDrawImageRectI GdipSetInterpolationMode GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdipSetTextRenderingHint GdipDrawString GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipCreateBitmapFromStream GdipCreateBitmapFromScan0 GdipDeleteBrush GdipCloneBrush GdipCreateSolidFill GdipDeleteGraphics GdipCreateFromHDC

psapi

GetProcessImageFileNameW GetModuleFileNameExW

riched20

ord4

crypt32

CryptBinaryToStringW CryptStringToBinaryW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminReleaseCatalogContext WinVerifyTrust CryptCATCatalogInfoFromContext CryptCATAdminEnumCatalogFromHash CryptCATAdminCalcHashFromFileHandle

ws2_32

getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet WSACleanup WSAStartup getsockopt htons setsockopt socket gethostbyname getaddrinfo getservbyname ntohs htonl shutdown freeaddrinfo gethostname ioctlsocket sendto recvfrom listen accept WSAIoctl WSAGetLastError

wldap32

ord147 ord301 ord208 ord133 ord14 ord46 ord145 ord79 ord142 ord167 ord127 ord27 ord26 ord41 ord118 ord216

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

netapi32

Netbios

iphlpapi

GetAdaptersInfo GetIpAddrTable

secur32

GetUserNameExW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

476KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

57KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=25, id=241, version=40116,

count=190, id=243, version=40116,

count=32, id=242, version=40116,

count=2, id=19, version=9049,

count=5, id=199, version=41118,

count=26, id=259, version=24123,

count=3, id=261, version=23013,

count=123, id=261, version=24123,

count=39, id=260, version=24123,

count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=51, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=632, id=1, productName=Unmarked objects,

count=85, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=494, id=260, productName=VS2015 UPD2 build 23918, version=23918,

count=130, id=265, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,