56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f

Sharing

Copy URL Twitter E-mail

General

Target
56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f
Size 1.4MB
Sample260720-dc2dbsc18q
SHA256 56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f
MD5 4f7262acc33c4bd9c95c4f35649cb63d
SHA1 d10a670e1ffceb827f8eed06724e37c98257c2f4
SHA512 b6a540667da3fcd353d0828583d83ed26187db3a051949302fa7a13863ebc4c342ba0df01461071d2ed42902e7731de9f396cb09c301724a1362508827d15ea0
SSDEEP 24576:BlMdgFvmm0lNgGTJOdm1E1yvBI553zcGg7H0W7AnMC:KevmFHV+1yvD7H/7a7
TLSH
T10C655C43B7B800D8D167C17CCA6B9507E6F2798613319ADF22908A571F23BF2A97DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f

File Explorer

56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f

.dll 1.4MB

56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f

IMPHASH dff03b86dc9d27f8aad9951aa215eb8c
SHA256 56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f
MD5 4f7262acc33c4bd9c95c4f35649cb63d
SHA1 d10a670e1ffceb827f8eed06724e37c98257c2f4
SHA512 b6a540667da3fcd353d0828583d83ed26187db3a051949302fa7a13863ebc4c342ba0df01461071d2ed42902e7731de9f396cb09c301724a1362508827d15ea0
SSDEEP 24576:BlMdgFvmm0lNgGTJOdm1E1yvBI553zcGg7H0W7AnMC:KevmFHV+1yvD7H/7a7
TLSH
T10C655C43B7B800D8D167C17CCA6B9507E6F2798613319ADF22908A571F23BF2A97DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

272208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ntdll

memset memcpy __chkstk

msvcrt

memmove fwrite ftell fseek fread atexit free malloc _wfopen fclose ferror

kernel32

ReleaseSemaphore CreateSemaphoreW GetCurrentThreadId GetTickCount GetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineW GetEnvironmentVariableW SetEnvironmentVariableW SetCurrentDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle DuplicateHandle HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess CreateThread CreateRemoteThread GetCurrentThread SuspendThread ResumeThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute FlushInstructionCache OpenProcess GetSystemInfo VirtualProtect VirtualFree VirtualQuery VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile FindResourceExW FreeLibrary GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LoadLibraryA LoadLibraryW EnumResourceNamesW LocalFree lstrcmpiA lstrcpyA lstrcpyW lstrlenA lstrlenW GetLocaleInfoW GetSystemDefaultUILanguage EnumUILanguagesW AllocConsole AttachConsole SetConsoleTitleW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent RaiseException SetLastError ResetEvent IsBadReadPtr IsBadWritePtr lstrcmpiW FindClose FindFirstFileW FindNextFileW WideCharToMultiByte GetVersionExW VirtualAlloc GetComputerNameW FileTimeToSystemTime OpenEventW GetLocalTime ReleaseMutex GlobalAlloc CreateMutexW OpenMutexW lstrcpynW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CopyFileW WaitForMultipleObjectsEx OpenThread ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileA GetFullPathNameW SetEndOfFile GetTempPathW GetSystemDirectoryW GetWindowsDirectoryW lstrcmpA SetErrorMode HeapCreate LockFileEx UnlockFileEx GetSystemTime SystemTimeToFileTime MultiByteToWideChar HeapReAlloc

user32

SetWindowPos SetTimer UpdateWindow BeginPaint EndPaint ShowWindow GetPropW LoadCursorW LoadIconW MonitorFromWindow GetMonitorInfoW SetPropW RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW MessageBoxW wsprintfW wsprintfA CreateWindowExW

gdi32

AddFontMemResourceEx SelectObject DeleteDC CreateCompatibleDC BitBlt

advapi32

SetSecurityDescriptorGroup RegDeleteKeyW RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetTokenInformation OpenProcessToken EqualSid GetSecurityDescriptorControl GetSecurityDescriptorLength IsTokenRestricted MakeSelfRelativeSD InitializeSecurityDescriptor SetSecurityDescriptorOwner RegCloseKey RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW RegOpenKeyW SetSecurityDescriptorSacl SetSecurityDescriptorDacl

shell32

SHGetFolderPathW

ole32

CLSIDFromString CoMarshalInterface CoUnmarshalInterface CoReleaseMarshalData CoTaskMemAlloc CoCreateInstance CoRegisterSurrogate CoCreateFreeThreadedMarshaler CoInitializeEx CoRegisterClassObject CoGetClassObject CoInitialize CoTaskMemFree StringFromCLSID CoUninitialize CreateStreamOnHGlobal CoLockObjectExternal CoFreeUnusedLibraries CoCreateGuid CoRevokeClassObject

oleaut32

SysAllocString SysFreeString SafeArrayDestroy SafeArrayPutElement SafeArrayCreateVector VariantInit SysAllocStringLen SysStringLen VariantChangeType VariantClear VarI4FromStr

BoxedAppSDK_AddExeToAttachableChildProcExclusionListA BoxedAppSDK_AddExeToAttachableChildProcExclusionListW BoxedAppSDK_AddExeToAttachableChildProcListA BoxedAppSDK_AddExeToAttachableChildProcListW BoxedAppSDK_AddHandler BoxedAppSDK_AddStartupDLLA BoxedAppSDK_AddStartupDLLW BoxedAppSDK_AddStubCandidateA BoxedAppSDK_AddStubCandidateW BoxedAppSDK_Alloc BoxedAppSDK_AttachToProcess BoxedAppSDK_CreateCustomVirtualDirectoryA BoxedAppSDK_CreateCustomVirtualDirectoryW BoxedAppSDK_CreateProcessFromMemoryA BoxedAppSDK_CreateProcessFromMemoryW BoxedAppSDK_CreateVirtualDirectoryA BoxedAppSDK_CreateVirtualDirectoryW BoxedAppSDK_CreateVirtualFileA BoxedAppSDK_CreateVirtualFileBasedOnBufferA BoxedAppSDK_CreateVirtualFileBasedOnBufferW BoxedAppSDK_CreateVirtualFileBasedOnIStreamA BoxedAppSDK_CreateVirtualFileBasedOnIStreamW BoxedAppSDK_CreateVirtualFileOnFilePartA BoxedAppSDK_CreateVirtualFileOnFilePartW BoxedAppSDK_CreateVirtualFileW BoxedAppSDK_CreateVirtualRegKeyA BoxedAppSDK_CreateVirtualRegKeyW BoxedAppSDK_DeleteFileFromVirtualFileSystemA BoxedAppSDK_DeleteFileFromVirtualFileSystemW BoxedAppSDK_DeleteVirtualRegKeyA BoxedAppSDK_DeleteVirtualRegKeyByHandle BoxedAppSDK_DeleteVirtualRegKeyW BoxedAppSDK_DetachFromProcess BoxedAppSDK_EmulateBoxedAppSDKDLL BoxedAppSDK_EnableDebugLog BoxedAppSDK_EnableDebugStatistics BoxedAppSDK_EnableHook BoxedAppSDK_EnableOption BoxedAppSDK_EnumVirtualRegKeysA BoxedAppSDK_EnumVirtualRegKeysW BoxedAppSDK_ExecuteDotNetApplicationA BoxedAppSDK_ExecuteDotNetApplicationExA BoxedAppSDK_ExecuteDotNetApplicationExW BoxedAppSDK_ExecuteDotNetApplicationW BoxedAppSDK_Exit BoxedAppSDK_Free BoxedAppSDK_GetDebugStatistics BoxedAppSDK_GetGlobalFileIsolationMode BoxedAppSDK_GetHookParam BoxedAppSDK_GetInternalValue BoxedAppSDK_GetOriginalFunction BoxedAppSDK_GetRegKeyIsolationModeA BoxedAppSDK_GetRegKeyIsolationModeW BoxedAppSDK_HookFunction BoxedAppSDK_HookFunctionWithParam BoxedAppSDK_IPC_AddListenerA BoxedAppSDK_IPC_AddListenerW BoxedAppSDK_IPC_RemoveListener BoxedAppSDK_IPC_SendMessageA BoxedAppSDK_IPC_SendMessageToProcessA BoxedAppSDK_IPC_SendMessageToProcessW BoxedAppSDK_IPC_SendMessageW BoxedAppSDK_Init BoxedAppSDK_InitById BoxedAppSDK_InstallAssemblyA BoxedAppSDK_InstallAssemblyW BoxedAppSDK_IsAttachedProcessId BoxedAppSDK_IsMainProcess BoxedAppSDK_IsOptionEnabled BoxedAppSDK_IsVirtualFileA BoxedAppSDK_IsVirtualFileW BoxedAppSDK_IsVirtualHandle BoxedAppSDK_IsVirtualProcessId BoxedAppSDK_IsVirtualRegValueA BoxedAppSDK_IsVirtualRegValueW BoxedAppSDK_PackerStubEntryPoint BoxedAppSDK_RegisterCOMLibraryInVirtualRegistryA BoxedAppSDK_RegisterCOMLibraryInVirtualRegistryW BoxedAppSDK_RegisterCOMServerInVirtualRegistryA BoxedAppSDK_RegisterCOMServerInVirtualRegistryW BoxedAppSDK_RemoteAgent_DetachThreadProc BoxedAppSDK_RemoteAgent_Exit BoxedAppSDK_RemoteAgent_Init BoxedAppSDK_RemoteAgent_ThreadProc BoxedAppSDK_RemoteProcess_EnableOption BoxedAppSDK_RemoteProcess_FreeLibrary BoxedAppSDK_RemoteProcess_IsOptionEnabled BoxedAppSDK_RemoteProcess_LoadLibraryA BoxedAppSDK_RemoteProcess_LoadLibraryW BoxedAppSDK_RemoveExeFromAttachableChildProcExclusionListA BoxedAppSDK_RemoveExeFromAttachableChildProcExclusionListW BoxedAppSDK_RemoveExeFromAttachableChildProcListA BoxedAppSDK_RemoveExeFromAttachableChildProcListW BoxedAppSDK_RemoveHandler BoxedAppSDK_RemoveStartupDLLA BoxedAppSDK_RemoveStartupDLLW BoxedAppSDK_RemoveStubCandidateA BoxedAppSDK_RemoveStubCandidateW BoxedAppSDK_RunDll32_Callback BoxedAppSDK_SetBxSdk32DllPathA BoxedAppSDK_SetBxSdk32DllPathW BoxedAppSDK_SetBxSdk32ShimDllPathA BoxedAppSDK_SetBxSdk32ShimDllPathW BoxedAppSDK_SetBxSdk64DllPathA BoxedAppSDK_SetBxSdk64DllPathW BoxedAppSDK_SetBxSdk64ShimDllPathA BoxedAppSDK_SetBxSdk64ShimDllPathW BoxedAppSDK_SetBxSdkRawData BoxedAppSDK_SetContext BoxedAppSDK_SetFileIsolationModeA BoxedAppSDK_SetFileIsolationModeW BoxedAppSDK_SetGlobalFileIsolationModeA BoxedAppSDK_SetGlobalFileIsolationModeW BoxedAppSDK_SetHookParam BoxedAppSDK_SetLogFileA BoxedAppSDK_SetLogFileW BoxedAppSDK_SetParam0 BoxedAppSDK_SetRegKeyIsolationModeA BoxedAppSDK_SetRegKeyIsolationModeW BoxedAppSDK_SetStartupFlags BoxedAppSDK_SetVirtualBoxedAppSDKDLLBaseDirA BoxedAppSDK_SetVirtualBoxedAppSDKDLLBaseDirW BoxedAppSDK_SetVirtualVolumeCreationTimeA BoxedAppSDK_SetVirtualVolumeCreationTimeW BoxedAppSDK_SetVirtualVolumeNameA BoxedAppSDK_SetVirtualVolumeNameW BoxedAppSDK_SetVirtualVolumeSerialA BoxedAppSDK_SetVirtualVolumeSerialW BoxedAppSDK_SharedMem_Alloc BoxedAppSDK_SharedMem_CreateStreamOnSharedMem BoxedAppSDK_SharedMem_Free BoxedAppSDK_SharedMem_Lock BoxedAppSDK_SharedMem_Unlock BoxedAppSDK_UnhookFunction BoxedAppSDK_WriteLogA BoxedAppSDK_WriteLogW BxCreateFileSandboxConfiguration BxCreateFileSystemLayerBasedOnSandboxDirectoryA BxCreateFileSystemLayerBasedOnSandboxDirectoryW BxCreateMemoryBasedRegistryLayer BxCreatePredefinedDirectoriesInfoProvider BxCreateReadonlyRegistryTree BxCreateReadonlyRegistryWriter BxCreateRegistryLayerBasedOnIBxRegTree BxCreateRegistryLayerOnFileA BxCreateRegistryLayerOnFileW BxCreateRegistryTreeOnFileA BxCreateRegistryTreeOnFileW BxCreateVirtualEnvironment BxInit bx_keep_fltused

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

243KB

Virtual Size

243KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

56d0d163ff75517176e9c0c02f66998c32819727702785618547078ef0ad931f

ntdll

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic