5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d

Sharing

Copy URL Twitter E-mail

General

Target
5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d
Size 14.0MB
Sample260722-gtpyeabc85
SHA256 5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d
MD5 c6ba9401e3ac2db499d23d3d57c48adc
SHA1 8d667b90762cf409ebc0824905f833ee632249f3
SHA512 281cc8a2deb25537db880ace3d013be5c0147cf3b171650514e609258adf5f07056a38821f21b9eb350cfaca92550118221b2d9c0c6e4c366d385c54baf4599b
SSDEEP 393216:kCb+mwaxzkquwZET14RZr4z6bfzhGU0K4lMI:viyk0zRz7YU0Kb
TLSH
T1C0E6333711551181E0E5CD3EAA3FBE9170F402778B8378786DF9E9C722395E1BA12A93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d

File Explorer

5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d

.exe 14.0MB

5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d

IMPHASH c2b942e0e51ea51ae0ca3179902fcc63
SHA256 5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d
MD5 c6ba9401e3ac2db499d23d3d57c48adc
SHA1 8d667b90762cf409ebc0824905f833ee632249f3
SHA512 281cc8a2deb25537db880ace3d013be5c0147cf3b171650514e609258adf5f07056a38821f21b9eb350cfaca92550118221b2d9c0c6e4c366d385c54baf4599b
SSDEEP 393216:kCb+mwaxzkquwZET14RZr4z6bfzhGU0K4lMI:viyk0zRz7YU0Kb
TLSH
T1C0E6333711551181E0E5CD3EAA3FBE9170F402778B8378786DF9E9C722395E1BA12A93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13283004

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvfw32

DrawDibDraw

avifil32

AVIStreamGetFrame AVIStreamInfoA

winmm

waveOutRestart midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader midiStreamStop midiOutReset midiStreamClose midiStreamRestart midiStreamOut PlaySoundA

ws2_32

ntohl accept getpeername recv connect ioctlsocket recvfrom socket htons WSAAsyncSelect closesocket send WSACleanup WSAStartup gethostbyname inet_ntoa inet_addr WSAGetLastError ntohs getservbyname shutdown setsockopt

kernel32

SetLastError GetTimeZoneInformation GetLocaleInfoA GetEnvironmentVariableA GetCurrentProcessId VirtualAlloc VirtualFree IsBadReadPtr CreateMutexA ReleaseMutex SuspendThread InterlockedIncrement InterlockedDecrement LocalFree FlushFileBuffers LockFile UnlockFile SetEndOfFile GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime RaiseException HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle HeapDestroy HeapCreate SetEnvironmentVariableW SetEnvironmentVariableA LCMapStringA LCMapStringW IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadCodePtr IsValidLocale IsValidCodePage EnumSystemLocalesA SetStdHandle GetLocaleInfoW SetNamedPipeHandleState WaitNamedPipeA OpenFileMappingA OpenEventA GetWindowsDirectoryA TerminateProcess TerminateThread SetFileTime DosDateTimeToFileTime GetLocalTime SystemTimeToFileTime UnmapViewOfFile GetCurrentProcess DuplicateHandle MapViewOfFile GetFileType GetFileSize SetFilePointer FileTimeToLocalFileTime FileTimeToSystemTime lstrcpynA lstrcmpiA lstrcmpA IsDBCSLeadByte CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource SizeofResource ReadFile lstrlenW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA GetPrivateProfileSectionNamesA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange GetVersion LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetSysColorBrush LoadStringA GetMenuCheckMarkDimensions SetMenuItemBitmaps CheckMenuItem IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx GetScrollPos RegisterClassA GetClassLongA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow EndPaint BeginPaint GetWindowTextLengthA GetForegroundWindow GetDlgItem GetClassNameA GetDesktopWindow CharUpperA GetWindowTextA SetWindowTextA GetMenuItemCount GetMenuItemID GetMenuStringA GetMenuState GetTabbedTextExtentA GrayStringA TabbedTextOutA WindowFromDC EnumChildWindows GetWindowDC UnhookWindowsHookEx CallNextHookEx SetWindowsHookExA GetPropA MoveWindow SetPropA DrawTextA GetCursor DrawStateA FrameRect GetNextDlgTabItem UnregisterHotKey RegisterHotKey CreateWindowExA CallWindowProcA LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle RegisterClipboardFormatA ReleaseCapture UnregisterClassA GetProcessWindowStation GetUserObjectInformationW

gdi32

CombineRgn PatBlt CreatePen SelectObject CreatePatternBrush CreateBitmap CreateBrushIndirect CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode SaveDC RestoreDC CreatePenIndirect PtVisible RectVisible ExtTextOutA Escape SetPolyFillMode SetROP2 SetWindowOrgEx SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo CreateRectRgn ExtSelectClipRgn GetViewportExtEx GetTextMetricsA SetBkMode TextOutA TranslateCharsetInfo CreateFontA SetBkColor CreateRectRgnIndirect CreateDIBSection SetPixel ExtCreateRegion SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect SetDIBitsToDevice FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage GetTextExtentPoint32A BitBlt SetMapMode GetDeviceCaps PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 SetTextColor

msimg32

GradientFill

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseFontA ChooseColorA

advapi32

RegCreateKeyExA RegQueryValueA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegEnumValueA

shell32

DragQueryFileA DragFinish DragAcceptFiles Shell_NotifyIconA ShellExecuteA

ole32

CLSIDFromProgID OleInitialize OleUninitialize CLSIDFromString CreateStreamOnHGlobal CoCreateInstance OleRun

oleaut32

VariantCopyInd SafeArrayGetElement SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound VariantChangeType VariantClear VariantCopy LoadTypeLi LHashValOfNameSys RegisterTypeLi SafeArrayPutElement SafeArrayCreate SafeArrayDestroy SysAllocString OleCreatePictureIndirect UnRegisterTypeLi VariantInit

comctl32

ImageList_AddMasked ord17 ImageList_EndDrag ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_Create ImageList_BeginDrag ImageList_Add ImageList_SetBkColor ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetIcon ImageList_Draw _TrackMouseEvent ImageList_Read ImageList_Write ImageList_DrawIndirect ImageList_Duplicate ImageList_Destroy

Name

.text

Size

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.svmp0

Size

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.svmp1

Size

13.9MB

Virtual Size

13.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

88KB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5e47cf003b06889976a3f2fa7d922fe6fbbb9ccfda717be814deacc2f61db09d

msvfw32

avifil32

winmm

ws2_32

kernel32

user32

gdi32

msimg32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

generic