c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3

Sharing

Copy URL Twitter E-mail

General

Target
c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3
Size 2.9MB
Sample260722-dlewpaxgkd
SHA256 c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3
MD5 9b46b0c0212e2b6f5e36d23b64237cc5
SHA1 e3cb39f3cbfe4635c04fdb185095d2187a607a63
SHA512 537f67cd616ee0d77fa2305d3662d63b76afd9db4580c358c69bccb1ee8ec32cf368c7239d5090dc8823595e493b7dd941d918b2d78056c610e9ca8f3e0ae16f
SSDEEP 49152:pEIbi9pYBETI5UBf3jiHaxeUqB9afLcoJtBT6w2yzYkDJNsko0SFYTGZdOPKv10E:pG9pYCf3saxeEBT6w2yzYyJ3oVgKv10E
TLSH
T1DAE58C2078418171DA670172AEAEBF6F585CAAB10B7894C3B3D06E1F3DB46D31B35297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3

File Explorer

c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3

.exe 2.9MB

c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3

IMPHASH 48443736bb7f25ee6eb4ed7a5f94d42e
SHA256 c62bc2aeb7beedec31a7763f6d6562b727203d2da6ac6e1a704e5e1576fd44f3
MD5 9b46b0c0212e2b6f5e36d23b64237cc5
SHA1 e3cb39f3cbfe4635c04fdb185095d2187a607a63
SHA512 537f67cd616ee0d77fa2305d3662d63b76afd9db4580c358c69bccb1ee8ec32cf368c7239d5090dc8823595e493b7dd941d918b2d78056c610e9ca8f3e0ae16f
SSDEEP 49152:pEIbi9pYBETI5UBf3jiHaxeUqB9afLcoJtBT6w2yzYkDJNsko0SFYTGZdOPKv10E:pG9pYCf3saxeEBT6w2yzYyJ3oVgKv10E
TLSH
T1DAE58C2078418171DA670172AEAEBF6F585CAAB10B7894C3B3D06E1F3DB46D31B35297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1716905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

soundlib

CreateSoundLib

winmm

waveOutGetDevCapsA waveOutClose waveOutGetNumDevs timeGetTime waveOutOpen waveOutSetVolume waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite waveOutReset waveInGetNumDevs waveInGetDevCapsA waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset

ss3dgfunc

_VECTOR3Length@4 _WriteTGA@24 _Normalize@8 _CrossProduct@12 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16 _SetInverseMatrix@8 _SetRotationYMatrix@8 _COLORtoDWORD@16

wsock32

socket send recv inet_addr htons connect closesocket WSACleanup WSAStartup gethostbyname ioctlsocket

dinput8

DirectInput8Create

kernel32

FileTimeToSystemTime HeapFree HeapAlloc ExitProcess GetModuleHandleExW AreFileApisANSI ExitThread LoadLibraryExW InitializeSListHead GetThreadTimes OutputDebugStringW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileSize CloseHandle GetLocalTime OpenFile IsDBCSLeadByte ReleaseMutex WaitForSingleObject CreateMutexA CreateDirectoryA GetTickCount DeleteFileA MultiByteToWideChar WideCharToMultiByte LCMapStringA Sleep GlobalAlloc GlobalLock GlobalUnlock lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary GetProcAddress LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency ReadFile CreateFileA GetLastError lstrcmpiA InterlockedCompareExchange GetModuleHandleA lstrcpynA WriteFile OpenProcess GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread GetModuleFileNameA GetFileAttributesA InterlockedExchange SystemTimeToTzSpecificLocalTime GetCurrentThread HeapReAlloc InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FindClose lstrcatA GetLogicalDriveStringsA GetTempPathA RemoveDirectoryA QueryDosDeviceA SetFileAttributesA FindFirstFileA FindNextFileA CopyFileA GetVersionExA GetSystemTimeAsFileTime GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA GetSystemTime GetModuleFileNameW GetProcessHeap FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetEvent GetModuleHandleW GetStartupInfoW IsProcessorFeaturePresent TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent RaiseException RtlUnwind GetStringTypeW FlushFileBuffers GetFileAttributesExW SetUnhandledExceptionFilter GetTimeZoneInformation SetStdHandle WriteConsoleW CreateFileW SetEndOfFile SetEnvironmentVariableA LocalFree CreateDirectoryW InitializeCriticalSectionAndSpinCount SetLastError UnhandledExceptionFilter GetCPInfo GetCommandLineA DecodePointer EncodePointer GetCurrentThreadId InterlockedExchangeAdd

user32

ReleaseDC wsprintfA SetRect MessageBoxA CharNextA CharPrevA GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CopyRect PostMessageA OffsetRect GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient GetDC SetCursor TranslateMessage DispatchMessageA PeekMessageA GetClientRect LoadCursorFromFileA LoadIconA SetWindowLongA GetWindowLongA ShowCursor EndPaint BeginPaint UpdateWindow EndMenu GetSystemMenu GetSystemMetrics KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExW CreateWindowExA RegisterClassExW RegisterClassExA PostQuitMessage DefWindowProcA UnregisterHotKey

gdi32

GetStockObject RemoveFontResourceExA AddFontResourceExA SelectObject GetTextExtentPoint32A DeleteObject CreateFontIndirectA

advapi32

RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance CoFreeUnusedLibraries CoUninitialize

oleaut32

VariantClear

freeimage

_FreeImage_SaveJPEG@12 _FreeImage_ConvertTo16Bits565@4 _FreeImage_GetInfo@4 _FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_Load@12

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameA EnumProcessModules GetModuleFileNameExW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

gdiplus

GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc

generic

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=225, version=20806,

count=3, id=199, version=41118,

count=50, id=223, productName=VS2013 build 21005, version=21005,

count=137, id=225, productName=VS2013 build 21005, version=21005,

count=244, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=334, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=662, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,