d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9

Sharing

Copy URL Twitter E-mail

General

Target
d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9
Size 3.7MB
Sample260722-v3sbsaaa64
SHA256 d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9
MD5 ea2bed472f656ec86a65027f2a59dd60
SHA1 48b178d45536521a1985f45c16399ca492ef0c2f
SHA512 95725e383305a3c9174863ca240c292f2236e1ea74b706ac22d2249cd50ecf95a7275b8757130e4e900fc9f4ce27216e3adba44971475a57ff78f7eecb74ec02
SSDEEP 49152:Db0y4Ct2lp7hEMVx9vRtW14aco2LTuEIcowoA5EUI88bFBeavBrPQzWHyc1EOTj7:ky4Ba2ZIc9cTBrozWHjiSjA8SRxeCE
TLSH
T14D06C066A2A811EED0B7D178DA479A07F671781647706FDB03A40A561F63FE01FBE380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9

File Explorer

d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9

.exe 3.7MB

d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9

IMPHASH f4d7ef629a92bea00e28d858b79a83d3
SHA256 d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9
MD5 ea2bed472f656ec86a65027f2a59dd60
SHA1 48b178d45536521a1985f45c16399ca492ef0c2f
SHA512 95725e383305a3c9174863ca240c292f2236e1ea74b706ac22d2249cd50ecf95a7275b8757130e4e900fc9f4ce27216e3adba44971475a57ff78f7eecb74ec02
SSDEEP 49152:Db0y4Ct2lp7hEMVx9vRtW14aco2LTuEIcowoA5EUI88bFBeavBrPQzWHyc1EOTj7:ky4Ba2ZIc9cTBrozWHjiSjA8SRxeCE
TLSH
T14D06C066A2A811EED0B7D178DA479A07F671781647706FDB03A40A561F63FE01FBE380
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1464780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MapViewOfFile HeapFree SetPriorityClass VirtualFree GetCurrentProcess VirtualAlloc SetThreadPriority InitializeCriticalSectionEx GetEnvironmentVariableA GetModuleHandleA EndUpdateResourceW GetExitCodeThread GetTickCount64 Process32NextW GlobalSize GetCurrentThread GetSystemDirectoryA K32GetModuleBaseNameA RaiseException HeapAlloc UpdateResourceW DecodePointer GlobalLock DeleteCriticalSection ExitProcess GetCurrentProcessId GetProcessHeap GetModuleHandleW BeginUpdateResourceW K32EnumProcessModules GlobalUnlock VirtualQuery GetComputerNameA GetFullPathNameA SetEnvironmentVariableA OpenFileMappingA HeapSize HeapReAlloc Sleep GetTempPathW SizeofResource GetFileSizeEx CreateFile2 FreeResource GetTempPathA LockResource CreateThread LoadResource FindResourceW CreateFileMappingFromApp SetThreadExecutionState MapViewOfFileFromApp GetModuleFileNameA SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryW QueryPerformanceCounter GetTickCount MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType ReadFile WaitForMultipleObjects FindClose FindNextFileW InitializeSRWLock GetNativeSystemInfo SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable CreateFileMappingA UnmapViewOfFile LocalAlloc WideCharToMultiByte GetCurrentDirectoryW GetLastError SetFilePointer LocalFileTimeToFileTime FreeLibrary LoadLibraryW VerifyVersionInfoW VerSetConditionMask GetWindowsDirectoryA CloseHandle MultiByteToWideChar WaitForSingleObject GetVolumeInformationA PeekNamedPipe RtlUnwind GetStartupInfoW GetSystemFirmwareTable GetProcAddress LoadLibraryA TryEnterCriticalSection InitOnceBeginInitialize GetCurrentThreadId InitializeConditionVariable GetStringTypeW WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetEndOfFile GetFullPathNameW GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW TerminateProcess GetModuleFileNameW GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode CreateDirectoryW SetEnvironmentVariableW SetFilePointerEx GetFileAttributesExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW FreeLibraryAndExitThread ExitThread DeleteFileW SetStdHandle GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx OutputDebugStringW GetCPInfo CompareStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx LocalFree EncodePointer InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter InitOnceComplete

user32

GetDesktopWindow ReleaseDC GetDC MessageBoxA

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDeviceCaps DeleteDC DeleteObject BitBlt

advapi32

CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptAcquireContextW OpenProcessToken SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor

ole32

CoInitializeSecurity CoSetProxyBlanket CreateStreamOnHGlobal CoCreateInstance CoUninitialize GetHGlobalFromStream CoInitializeEx

oleaut32

VariantInit SysFreeString SysAllocString SafeArrayPutElement SafeArrayCreate VariantClear

shlwapi

PathRemoveFileSpecA

ws2_32

WSAAccept WSASocketW getaddrinfo getpeername getsockname send socket ntohs recv freeaddrinfo getnameinfo setsockopt WSACleanup gethostbyname WSAStartup inet_ntoa __WSAFDIsSet listen gethostname ioctlsocket sendto recvfrom htonl accept shutdown WSAIoctl WSASetLastError htons getsockopt connect WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent bind closesocket select

wldap32

ord145 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord301

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup

ntdll

NtQuerySystemInformation RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

374KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.\LL

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d67f6099f902690077925315580b322cbd56044584e3deaefd5d2e6f49c0bcc9

kernel32

user32

gdi32

advapi32

ole32

oleaut32

shlwapi

ws2_32

wldap32

gdiplus

ntdll

generic