2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5

Sharing

Copy URL Twitter E-mail

General

Target
2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5
Size 3.0MB
Sample260718-lc6xtae19n
SHA256 2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5
MD5 243f4802f404a7135081f8f43d788c1f
SHA1 eaa4de5872608357fe8a4736565f73d6cd8990a6
SHA512 959c6983efb695532a171fd6e808d844360a7a07648d65f2b036633706fccf305e6d4ba2f4b9631d177a20ae18f67b16c4ecf6ef4f295d6caf504f139fe7c544
SSDEEP 49152:heQxwCQxTYqAgMhI6EWlaARfFyV9uVx5cUW9OIZo2+91UgUWt2Ab7qXEfRLDIqS:0Qs/MOVWlaGF6wVxGUWRZYhv0mWkkqSw
TLSH
T147E53347515311A8C5D3A478ABB3B79071B021A601C198227EC91D8BF7E2FA3D78FBB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5

File Explorer

2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5

.exe 3.0MB

2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5

IMPHASH b635bfa266c8a02ba193f1769f20aa7e
SHA256 2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5
MD5 243f4802f404a7135081f8f43d788c1f
SHA1 eaa4de5872608357fe8a4736565f73d6cd8990a6
SHA512 959c6983efb695532a171fd6e808d844360a7a07648d65f2b036633706fccf305e6d4ba2f4b9631d177a20ae18f67b16c4ecf6ef4f295d6caf504f139fe7c544
SSDEEP 49152:heQxwCQxTYqAgMhI6EWlaARfFyV9uVx5cUW9OIZo2+91UgUWt2Ab7qXEfRLDIqS:0Qs/MOVWlaGF6wVxGUWRZYhv0mWkkqSw
TLSH
T147E53347515311A8C5D3A478ABB3B79071B021A601C198227EC91D8BF7E2FA3D78FBB5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

236696760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ddraw

DirectDrawCreate

dsound

ord1

winmm

mmioDescend mciSendCommandA timeGetTime mmioRead mmioClose mmioAscend mmioOpenA

dinput

DirectInputCreateA

wsock32

ioctlsocket socket connect htons inet_ntoa setsockopt WSACleanup __WSAFDIsSet WSAStartup gethostbyname closesocket WSAGetLastError recv send select

lua51

luaL_checknumber luaL_addvalue luaL_error luaL_prepbuffer luaL_loadstring lua_pushinteger luaL_register lua_pushnumber lua_pushstring luaL_checkinteger luaL_checklstring luaL_buffinit lua_type luaL_ref lua_getfield luaL_addlstring lua_pushcclosure lua_isnumber luaL_newstate lua_tonumber lua_tolstring lua_isstring lua_call lua_remove lua_gettop lua_gc luaL_loadfile lua_insert luaL_openlibs lua_settop lua_pcall lua_pushvalue

dbghelp

SymCleanup SymGetModuleBase64 SymGetOptions SymGetModuleInfo64 SymGetLineFromAddr64 SymInitialize StackWalk64 SymSetOptions SymFromAddr SymFunctionTableAccess64

kernel32

LCMapStringW CompareStringW GetStringTypeW GetStdHandle GetFileType CreateFileW GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW CreateEventW WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter SetFilePointerEx GetConsoleMode ReadConsoleW FlushFileBuffers SetLastError TerminateProcess WaitForSingleObject OpenProcess GetLastError CloseHandle ExitProcess CreateProcessA VirtualProtect VirtualFree GetCurrentProcess VirtualAlloc GetCurrentThreadId GetCurrentThread WriteFile SetStdHandle GetConsoleCP GetProcAddress GetModuleHandleW FreeLibrary LoadLibraryExW GetTickCount FindFirstFileA FindNextFileA FindClose lstrcatA lstrcpyA IsDBCSLeadByte GetCurrentDirectoryA GlobalLock GlobalUnlock VerifyVersionInfoA HeapFree GetFileAttributesA CreateFileA HeapAlloc GetLocalTime VerSetConditionMask GetProcessHeap ReadFile CreateNamedPipeA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ReleaseMutex DisconnectNamedPipe Sleep SetEvent CreateThread ResetEvent DeleteCriticalSection CreateDirectoryA CreateEventA ConnectNamedPipe LCMapStringA MultiByteToWideChar WideCharToMultiByte GetModuleFileNameA Process32First SetErrorMode CreateMutexA GetACP GetVersion CreateToolhelp32Snapshot LoadLibraryA QueryPerformanceFrequency Process32Next CreateFileMappingA GetCurrentProcessId GlobalMemoryStatusEx OpenFileMappingA MapViewOfFile IsDebuggerPresent GetComputerNameA SetUnhandledExceptionFilter DeleteFileA OutputDebugStringA QueryPerformanceCounter WaitForMultipleObjects ExitThread HeapDestroy HeapCreate GetSystemInfo HeapReAlloc GetTimeZoneInformation CreateDirectoryW GetFileAttributesExW DeleteFileW FindFirstFileExA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW HeapSize SetEndOfFile UnmapViewOfFile DecodePointer GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers VirtualQuery

user32

GetKeyboardLayout GetKeyState SetWindowLongA ClientToScreen SetWindowsHookExA ChangeDisplaySettingsA RegisterClassA UnhookWindowsHookEx DefWindowProcA CreateWindowExA TranslateMessage GetMessageW GetClientRect PeekMessageA OffsetRect DispatchMessageA UpdateWindow ReleaseDC SetWindowTextA SetTimer ShowCursor PostMessageA MessageBoxA OpenClipboard LoadIconA AdjustWindowRectEx DispatchMessageW GetAsyncKeyState wsprintfA GetClipboardData CloseClipboard LoadCursorA DestroyWindow GetDC SetWindowPos CallNextHookEx PostQuitMessage ShowWindow SetRect

gdi32

CreateCompatibleDC SelectObject DeleteObject CreateDCA AddFontResourceA GetDeviceCaps GetStockObject TextOutA SetTextColor CreateFontA SetBkMode GetTextExtentPoint32A

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteA

dxgi

CreateDXGIFactory

netapi32

Netbios

psapi

EnumProcessModules GetModuleFileNameExA EnumProcesses

libeay32

ord339

imm32

ImmAssociateContext ImmCreateContext ImmSetOpenStatus ImmGetOpenStatus ImmGetProperty ImmIsIME ImmDestroyContext ImmGetConversionStatus ImmGetDescriptionA

Name

.text

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

220.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mydata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.md@

Size

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.5$j

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.;D^

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2bb1f59e57898e2c98ef5941e0a32d4bb92af5fc6849b9fbb60013b8b4b8cab5

ddraw

dsound

winmm

dinput

wsock32

lua51

dbghelp

kernel32

user32

gdi32

advapi32

shell32

dxgi

netapi32

psapi

libeay32

imm32

generic