5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f

Sharing

Copy URL Twitter E-mail

General

Target
5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f
Size 4.0MB
Sample260721-rt9b6awsds
SHA256 5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f
MD5 75f61b0836305d6c67704f2d4df5342c
SHA1 3ba60b4c8f52b2072d6b4b3c9cdda159eaa0b97e
SHA512 faeeb582a04c28354994fbc0c61348ba94c8f8e7ceebbe383b7e700726937fcba57a5456b93ee658aa5949a4a926b39aa859386267495f92f79e0f637a932a09
SSDEEP 49152:RvxfIXQ5fCJXOX5I3qxONI+uCuc2JXThmqEPveSrnNibWLk:2AfLcOwBewk
TLSH
T1EA164B6A1EFC4628E466C17C9A674762AEB2B4103B35E6FF45401095DF207E0B73EB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f

File Explorer

5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f

.exe 4.0MB

5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f

IMPHASH dee34dd2bbd1d6fce36544696fc4ec33
SHA256 5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f
MD5 75f61b0836305d6c67704f2d4df5342c
SHA1 3ba60b4c8f52b2072d6b4b3c9cdda159eaa0b97e
SHA512 faeeb582a04c28354994fbc0c61348ba94c8f8e7ceebbe383b7e700726937fcba57a5456b93ee658aa5949a4a926b39aa859386267495f92f79e0f637a932a09
SSDEEP 49152:RvxfIXQ5fCJXOX5I3qxONI+uCuc2JXThmqEPveSrnNibWLk:2AfLcOwBewk
TLSH
T1EA164B6A1EFC4628E466C17C9A674762AEB2B4103B35E6FF45401095DF207E0B73EB72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3081680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

oleaut32

SysFreeString SysReAllocStringLen

user32

MessageBoxA SetWindowLongPtrA SetWindowLongPtrW GetWindowLongPtrW CreateWindowExA CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TranslateAcceleratorA TrackPopupMenu SystemParametersInfoA SystemParametersInfoW SwitchDesktop AnimateWindow ShowWindow ShowScrollBar ShowCaret SetWindowsHookExA SetWindowTextA SetWindowTextW SetWindowPos SetTimer SetScrollInfo SetParent SetMenuItemInfoW SetMenuItemBitmaps SetMenuDefaultItem SetMenu SetKeyboardState SetForegroundWindow SetFocus SetDlgItemTextA SetDlgItemTextW SetCursorPos SetCursor SetClipboardData SetCaretPos SetCapture SetActiveWindow SendMessageA SendMessageW SendInput SendDlgItemMessageA SendDlgItemMessageW ScrollWindow ReleaseDC ReleaseCapture RegisterWindowMessageA RegisterClipboardFormatA RegisterClassA RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageW OpenDesktopW OpenClipboard OffsetRect OemToCharBuffA OemToCharA MoveWindow ModifyMenuA ModifyMenuW MessageBoxA MessageBoxW MessageBeep MapWindowPoints LoadMenuA LoadImageA LoadIconA LoadCursorA LoadCursorW LoadAcceleratorsA KillTimer IsZoomed IsWindowVisible IsWindowEnabled IsWindow IsIconic IsDlgButtonChecked IsDialogMessageW IsClipboardFormatAvailable InvertRect InvalidateRect IntersectRect InsertMenuA InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextLengthW GetWindowTextA GetWindowTextW GetWindowRect GetWindowInfo GetWindowDC GetSystemMetrics GetSystemMenu GetSysColor GetSubMenu GetScrollPos GetScrollInfo GetParent GetWindow GetNextDlgTabItem GetMessageW GetMenuStringA GetMenuStringW GetMenuState GetMenuItemID GetMenuItemCount GetKeyboardState GetKeyState GetIconInfo GetForegroundWindow GetFocus GetDlgItemTextA GetDlgItemTextW GetDlgItemInt GetDlgItem GetDlgCtrlID GetDC GetCursorPos GetClipboardFormatNameW GetClipboardData GetClientRect GetClassNameA GetClassNameW GetClassInfoW GetCapture GetAsyncKeyState GetActiveWindow FindWindowA FindWindowW FillRect ExitWindowsEx EnumClipboardFormats EnumChildWindows EndPaint EndDialog EnableWindow EnableMenuItem EmptyClipboard DrawTextA DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DispatchMessageW DialogBoxParamW DestroyWindow DestroyMenu DestroyIcon DestroyCaret DeleteMenu DefWindowProcA DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateMDIWindowW CreateCaret CountClipboardFormats CopyImage CloseClipboard ChildWindowFromPointEx CheckRadioButton CheckMenuRadioItem CheckMenuItem CheckDlgButton CharUpperBuffW CharUpperW CharNextW CharLowerBuffW CharLowerW CallWindowProcA CallWindowProcW CallNextHookEx BringWindowToTop BeginPaint AppendMenuA AppendMenuW CharLowerBuffA CharLowerA CharUpperBuffA CharUpperA CharToOemBuffA CharToOemA GetMonitorInfoA MonitorFromWindow

kernel32

Sleep VirtualFree VirtualAlloc HeapFree HeapAlloc GetProcessHeap VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx SetThreadLocale WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP GetStartupInfoW GetProcAddress GetModuleHandleW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwindEx RtlUnwind RaiseException ExitProcess GetCurrentThreadId DeleteCriticalSection InitializeCriticalSection WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize DeleteFileW CreateFileW GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary lstrcpynW lstrcpyA lstrcpyW lstrcmpiA lstrcmpW lstrcatW WriteFile WinExec WideCharToMultiByte WaitForSingleObject VirtualQueryEx VirtualQuery VirtualProtectEx VirtualProtect VirtualFree VirtualAlloc UnlockFile TryEnterCriticalSection TerminateThread TerminateProcess SystemTimeToFileTime SuspendThread Sleep SizeofResource SetUnhandledExceptionFilter SetThreadPriority SetThreadContext SetPriorityClass SetLastError SetFileTime SetFilePointer SetFileAttributesA SetFileAttributesW SetEvent SetEndOfFile SetCurrentDirectoryW ResumeThread ResetEvent RemoveDirectoryW ReadFile QueryPerformanceFrequency QueryPerformanceCounter QueryDosDeviceW PeekNamedPipe OpenProcess MultiByteToWideChar MulDiv MoveFileW LockResource LockFile LocalUnlock LocalLock LocalFree LocalFileTimeToFileTime LocalAlloc LoadResource LoadLibraryExA LoadLibraryExW LoadLibraryA LoadLibraryW LeaveCriticalSection IsBadWritePtr IsBadReadPtr InitializeCriticalSection HeapValidate GlobalUnlock GlobalSize GlobalMemoryStatus GlobalLock GlobalFree GlobalAlloc GetWindowsDirectoryA GetWindowsDirectoryW GetVolumeInformationA GetVolumeInformationW GetVersionExW GetTimeZoneInformation GetTickCount GetThreadTimes GetThreadLocale GetThreadContext GetTempPathW GetTempFileNameW GetSystemTimeAsFileTime GetSystemTime GetSystemPowerStatus GetSystemInfo GetStdHandle GetShortPathNameA GetProcessVersion GetProcessTimes GetProcessHeap GetProcAddress GetModuleHandleA GetModuleHandleW GetModuleFileNameA GetModuleFileNameW GetLocaleInfoA GetLocalTime GetLastError GetHandleInformation GetFileTime GetFileSize GetFileInformationByHandle GetFileAttributesA GetFileAttributesW GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeA GetDriveTypeW GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDiskFreeSpaceA GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryA GetCurrentDirectoryW GetCommandLineW GetACP FreeLibrary FormatMessageA FormatMessageW FlushInstructionCache FlushFileBuffers FindResourceA FindNextFileA FindNextFileW FindFirstFileA FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime EnumSystemCodePagesA EnterCriticalSection DuplicateHandle DosDateTimeToFileTime DeviceIoControl DeleteFileA DeleteFileW DeleteCriticalSection CreateThread CreateProcessA CreateProcessW CreatePipe CreateMutexA CreateHardLinkW CreateFileA CreateFileW CreateEventA CreateDirectoryW CopyFileW CompareStringW CloseHandle Beep GetLongPathNameA GetLongPathNameW GlobalMemoryStatusEx FindVolumeClose FindNextVolumeW FindFirstVolumeW GetCPInfoExW GetCPInfoExA RtlCaptureStackBackTrace GetDiskFreeSpaceExW GetProcAddress GetComputerNameExW SetFilePointerEx GetVolumePathNamesForVolumeNameW OpenThread GetFileSizeEx FreeUserPhysicalPages AllocateUserPhysicalPages GetSystemWindowsDirectoryW

gdi32

TextOutA TextOutW StretchDIBits StartPage StartDocA StartDocW SetWorldTransform SetTextColor SetTextAlign SetPixelV SetPixel SetGraphicsMode SetDIBits SetBkMode SetBkColor SelectObject SelectClipRgn Rectangle RectVisible PtInRegion Polygon MoveToEx ModifyWorldTransform LineTo GetTextMetricsA GetTextExtentPoint32A GetTextExtentPoint32W GetTextColor GetStockObject GetPixel GetObjectA GetObjectW GetDeviceCaps GetCharABCWidthsFloatW GetBkColor GetBitmapBits ExtTextOutA ExtTextOutW EndPage EndDoc DeleteObject DeleteDC CreateSolidBrush CreateRectRgn CreatePen CreateFontIndirectA CreateFontIndirectW CreateFontA CreateFontW CreateDIBitmap CreateDIBSection CreateDCA CreateCompatibleDC CreateCompatibleBitmap BitBlt AbortDoc

advapi32

SetSecurityDescriptorDacl SetFileSecurityW RegSetValueExA RegSetValueExW RegSetValueA RegSetValueW RegQueryValueExA RegQueryValueExW RegQueryValueW RegOpenKeyExA RegOpenKeyA RegDeleteValueW RegDeleteKeyA RegDeleteKeyW RegCreateKeyA RegCreateKeyW RegCloseKey OpenProcessToken LookupPrivilegeValueA LookupAccountNameW IsTextUnicode InitializeSecurityDescriptor InitializeAcl GetUserNameW GetSecurityDescriptorDacl GetLengthSid GetFileSecurityW GetCurrentHwProfileA GetAclInformation GetAce AdjustTokenPrivileges AddAce AddAccessAllowedAce

shell32

SHGetFileInfoA SHGetFileInfoW ShellExecuteA ShellExecuteW ExtractIconA ExtractIconW ExtractAssociatedIconW DragQueryPoint DragQueryFileW DragFinish DragAcceptFiles SHGetFolderPathW SHGetPathFromIDListW SHBrowseForFolderW

winspool.drv

GetDefaultPrinterA OpenPrinterA EnumPrintersA DocumentPropertiesA ClosePrinter

msvcrt

memset

powrprof

SetSuspendState

comctl32

ImageList_GetIconSize ImageList_Draw ImageList_SetBkColor ImageList_ReplaceIcon ImageList_Add ImageList_Destroy ImageList_Create

setupapi

SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsW

winhttp

WinHttpSetOption WinHttpSendRequest WinHttpReceiveResponse WinHttpReadData WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpOpen WinHttpConnect WinHttpCloseHandle

winmm

PlaySoundA

comdlg32

CommDlgExtendedError ChooseFontA ChooseColorA GetSaveFileNameW GetOpenFileNameW

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

184KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

73KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

616KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5ac6a2170ce4f12293138c6be510102a53c67503089ae5e3469005497dec9f8f

oleaut32

user32

kernel32

gdi32

advapi32

shell32

winspool.drv

msvcrt

powrprof

comctl32

setupapi

winhttp

winmm

comdlg32

generic