0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d

Sharing

Copy URL Twitter E-mail

General

Target
0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d
Size 3.0MB
Sample260722-mj1vtatanf
SHA256 0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d
MD5 0a407a335bc09611c9ec2647bda6f6fa
SHA1 f1393be8f12dd9cdfa6c473eea8e51946cf8a11c
SHA512 8b7cc6ad05b1578306e7cd332be9737faa508074b799cbe0a2e5af16a1e877d70cf307248a6cd151185b3e86c7d3fdc394898b70ee8fa098133799d16ef47fb0
SSDEEP 49152:8GnNd48vnGnfevbotse/aAyAEU+J69Nvfm6lx50i6Rm2vGaCJQx:BnLNeseS767vp5Qs2v3CCx
TLSH
T1CEE57CE27A4289B1D999237035A59B3547FBBC220470A347D7CBB12E5F71381E227BB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d

File Explorer

0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d

.dll 3.0MB

0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d

IMPHASH 93c6af6f06430ad95b3f76225a144fa2
SHA256 0348f39de0fad257ef36aa478a95fb48bb5bdb520aff8ec95b363cbac4e8c67d
MD5 0a407a335bc09611c9ec2647bda6f6fa
SHA1 f1393be8f12dd9cdfa6c473eea8e51946cf8a11c
SHA512 8b7cc6ad05b1578306e7cd332be9737faa508074b799cbe0a2e5af16a1e877d70cf307248a6cd151185b3e86c7d3fdc394898b70ee8fa098133799d16ef47fb0
SSDEEP 49152:8GnNd48vnGnfevbotse/aAyAEU+J69Nvfm6lx50i6Rm2vGaCJQx:BnLNeseS767vp5Qs2v3CCx
TLSH
T1CEE57CE27A4289B1D999237035A59B3547FBBC220470A347D7CBB12E5F71381E227BB1
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83858

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OpenProcess TerminateProcess GetExitCodeProcess GetLastError WaitForSingleObject CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId GetModuleHandleW GetVersionExW LocalFree InterlockedDecrement LockResource GlobalLock GlobalUnlock LoadResource SizeofResource FindResourceW lstrcpynW ReadConsoleW SetEndOfFile WriteConsoleW SetFilePointerEx SetStdHandle FlushFileBuffers SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA GetTimeZoneInformation GetACP GetConsoleMode GetConsoleCP LocalAlloc GlobalFree GlobalAlloc CreateDirectoryW GetCurrentProcessId CreateFileW CloseHandle FindClose ReadFile WriteFile WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW GetModuleFileNameW FreeLibrary lstrlenW LoadLibraryW GetCurrentProcess GetProcAddress InterlockedIncrement GetFileType GetStdHandle GetModuleFileNameA GetModuleHandleExW ExitProcess LoadLibraryExW InterlockedFlushSList RtlUnwind OutputDebugStringW InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCPInfo GetStringTypeW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError EncodePointer LeaveCriticalSection EnterCriticalSection QueryPerformanceCounter

user32

GetSystemMetrics DrawIconEx DestroyIcon InsertMenuW SetMenuItemInfoW InsertMenuItemW LoadStringW wsprintfW SetMenuInfo

advapi32

CreateProcessAsUserW DuplicateTokenEx LookupAccountSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetTokenInformation GetTokenInformation OpenProcessToken ImpersonateLoggedOnUser RevertToSelf RegDeleteValueW RegDeleteKeyW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW SHGetPathFromIDListW DragFinish DragQueryFileW SHGetSpecialFolderPathW

ole32

ReleaseStgMedium CreateStreamOnHGlobal

shlwapi

PathFileExistsW PathFindExtensionW

gdiplus

GdipGetImageWidth GdipGetImageHeight GdipGetImagePixelFormat GdipCreateBitmapFromStream GdipCreateBitmapFromStreamICM GdipGetImageGraphicsContext GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDrawImagePointRectI GdipDrawImageRectI GdipSetInterpolationMode GdipSetSmoothingMode GdipDeleteGraphics GdipCreateHICONFromBitmap GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

generic

count=13, id=241, version=40116,

count=164, id=243, version=40116,

count=29, id=242, version=40116,

count=2, id=261, version=23013,

count=1, id=199, version=41118,

count=23, id=259, version=24123,

count=47, id=261, version=24123,

count=35, id=260, version=24123,

count=4, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=238, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=31, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,