75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b

Sharing

Copy URL Twitter E-mail

General

Target
75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b
Size 7.9MB
Sample260719-ync54aax5r
SHA256 75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b
MD5 c2e3869826b92b9ece3ccedc1cbb219a
SHA1 63469b842ed6263682ad5032f12839f295a208ef
SHA512 3e2c59600201880183a70fcfefd361a5745fb66e65aace499fcbf7fe7f3eb1a3f6471527364e5f238071d62f6efa249f670779c171c131330745a5a891957cec
SSDEEP 196608:Xk4TED8cBHT0q/G4usUAz3b2ulMTfvmWwvh7RsxG6ha:XZs/HOtRfvm1hteG6U
TLSH
T1E886225163AE0299E8734130696C31328775BD6087F0A9CF326C755B6B3F6906E3AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b

File Explorer

75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b

.exe 7.9MB

75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b

IMPHASH 000549e5542644ced8d0a36c575dc0ab
SHA256 75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b
MD5 c2e3869826b92b9ece3ccedc1cbb219a
SHA1 63469b842ed6263682ad5032f12839f295a208ef
SHA512 3e2c59600201880183a70fcfefd361a5745fb66e65aace499fcbf7fe7f3eb1a3f6471527364e5f238071d62f6efa249f670779c171c131330745a5a891957cec
SSDEEP 196608:Xk4TED8cBHT0q/G4usUAz3b2ulMTfvmWwvh7RsxG6ha:XZs/HOtRfvm1hteG6U
TLSH
T1E886225163AE0299E8734130696C31328775BD6087F0A9CF326C755B6B3F6906E3AB37
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

213024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

BootContainer.pdb

rpcrt4

UuidCreate

kernel32

MulDiv HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap lstrcpynW WaitForSingleObject GetExitCodeProcess CreateMutexA SetEvent SetProcessShutdownParameters SetThreadLocale SetThreadUILanguage GetUserDefaultLangID EnumResourceLanguagesW GetThreadLocale GetSystemDirectoryW GetCommandLineW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle ExitProcess GetCommandLineA EnterCriticalSection ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx OutputDebugStringW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCPInfo RaiseException RtlPcToFileHeader GetExitCodeThread WaitForSingleObjectEx FindFirstFileExW GetStringTypeW DeleteCriticalSection LoadLibraryExW GetModuleFileNameW GetLocaleInfoW FreeLibrary GetProcAddress LoadLibraryW FreeResource FindResourceExW WideCharToMultiByte MultiByteToWideChar GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter GetCurrentDirectoryW LocalFree LeaveCriticalSection MoveFileExW CreateDirectoryW RemoveDirectoryW FindNextFileW UnmapViewOfFile MapViewOfFile SetFileTime FindClose FindFirstFileW SetFileAttributesW FlushFileBuffers GetTempPathW CopyFileW DeleteFileW SetEndOfFile WriteFile ReadFile LocalFileTimeToFileTime DosDateTimeToFileTime LockResource LoadResource SizeofResource FindResourceW GetCurrentProcess GetLastError GetCurrentThread GetSystemTimeAsFileTime GetModuleHandleW InitializeCriticalSection SetLastError WriteConsoleW FreeLibraryAndExitThread

user32

PeekMessageW TranslateMessage EnableWindow GetSystemMetrics GetDC ReleaseDC GetPropW GetClientRect GetWindowRect SetForegroundWindow RegisterWindowMessageW PostQuitMessage LoadAcceleratorsW GetClassInfoW LoadIconW LoadCursorW RegisterClassExW SetPropW RemovePropW GetWindowLongW SetWindowPos InvalidateRect CopyRect DrawFocusRect InflateRect OffsetRect PtInRect EndPaint BeginPaint RedrawWindow FindWindowExW SystemParametersInfoW DrawTextW wsprintfW TranslateAcceleratorW MsgWaitForMultipleObjectsEx DialogBoxIndirectParamW EndDialog CreateDialogIndirectParamW GetDlgItem LoadImageW ScreenToClient IsWindowVisible KillTimer SetTimer IsWindowEnabled SetWindowTextW GetWindowTextW GetWindowTextLengthW MapWindowPoints GetDesktopWindow MonitorFromWindow GetWindow GetParent ShowWindow SendMessageW

gdi32

SetStretchBltMode LineTo MoveToEx SetDCPenColor CreateFontIndirectW CreateBitmap BitBlt SetDCBrushColor SetBkMode SetTextColor GetObjectW SelectObject CreateSolidBrush ExtTextOutW SetBkColor DeleteObject GetDeviceCaps StretchBlt Ellipse CreateCompatibleDC GetStockObject

advapi32

OpenProcessToken AllocateAndInitializeSid RegGetValueW RegGetValueA RegEnumKeyExA RegQueryInfoKeyW EqualSid FreeSid OpenThreadToken

shell32

CommandLineToArgvW ShellExecuteExW

ole32

StringFromGUID2

gdiplus

GdipFree GdiplusShutdown GdiplusStartup GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipAlloc GdipCloneImage GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipSetImageAttributesWrapMode GdipDisposeImageAttributes GdipCreateImageAttributes GdipSaveImageToStream

Name

.text

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

85.5MB

Virtual Size

85.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

75d935c85308bc8d9b40a571f2b86e3a1d7f0e0515919fce2a12e20e6c7be50b

rpcrt4

kernel32

user32

gdi32

advapi32

shell32

ole32

gdiplus

generic