761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7

Sharing

Copy URL Twitter E-mail

General

Target
761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7
Size 467KB
Sample260723-qcaa3azbmb
SHA256 761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7
MD5 78d397f2fc496f8b79b727a44d474f39
SHA1 053466b1a36216f666d9076d2fde2cd7e118f8ee
SHA512 4c27e101ca26cee4138dda53995f8bccf076fb04182c9e8805cfdd7747aa0a68f4c0006e840b2a937d87dee06fcf5b5900cf636fb8eeeb8f1964d028b2fc63c2
SSDEEP 12288:JtzPQdquSvex1mIozahj0KjW7NFn2FRLeCi:JtzPQVoze0KjW7NUF4Ci
TLSH
T1E9A49E2235B1C032D4A281315E39EFA6667DFD304F6249CBB3D42A6E6F706C19B35B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7

File Explorer

761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7

.exe 467KB

761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7

IMPHASH 23b0accb99d601ea166b8ce3b13b44bd
SHA256 761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7
MD5 78d397f2fc496f8b79b727a44d474f39
SHA1 053466b1a36216f666d9076d2fde2cd7e118f8ee
SHA512 4c27e101ca26cee4138dda53995f8bccf076fb04182c9e8805cfdd7747aa0a68f4c0006e840b2a937d87dee06fcf5b5900cf636fb8eeeb8f1964d028b2fc63c2
SSDEEP 12288:JtzPQdquSvex1mIozahj0KjW7NFn2FRLeCi:JtzPQVoze0KjW7NUF4Ci
TLSH
T1E9A49E2235B1C032D4A281315E39EFA6667DFD304F6249CBB3D42A6E6F706C19B35B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

208437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

rpcrt4

RpcServerInqCallAttributesW NdrCStdStubBuffer2_Release NdrStubForwardingFunction IUnknown_Release_Proxy NdrOleFree NdrStubCall2 IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleAllocate

kernel32

CreateThread GetCurrentThread GetCurrentThreadId GetVersionExW LocalAlloc LocalFree GetLocalTime OpenProcess QueryFullProcessImageNameW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetShortPathNameW RemoveDirectoryW CopyFileW MoveFileExW ProcessIdToSessionId FindResourceExW LockResource CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueTimer DeleteTimerQueueEx OpenMutexW GetCurrentProcessId CreateProcessW GetTickCount GetWindowsDirectoryW WritePrivateProfileStringW CreateFileW ReadFile GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetCurrentProcess GetDateFormatW GetTimeZoneInformation GetFileSizeEx ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType WriteFile GetStdHandle ExitProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionAndSpinCount Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent RaiseException CloseHandle OutputDebugStringW GetCommandLineW MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress AcquireSRWLockExclusive GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError DecodePointer GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile WriteConsoleW SetLastError RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo CompareStringEx GetTimeFormatW GetStringTypeW WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter GetLocaleInfoEx EncodePointer LCMapStringEx ReleaseSRWLockExclusive

user32

DispatchMessageW MessageBoxW PostThreadMessageW CharUpperW TranslateMessage LoadStringW CharNextW GetMessageW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW ord680 SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoTaskMemFree CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoCreateGuid CoAddRefServerProcess CoTaskMemAlloc CoTaskMemRealloc

oleaut32

BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize UnRegisterTypeLi RegisterTypeLi BSTR_UserFree LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysFreeString SysAllocString VariantClear

advapi32

InitializeSecurityDescriptor RegCreateKeyExW RegDeleteKeyW SetTokenInformation RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegQueryValueExW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorSacl SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl IsValidSid InitializeAcl GetTokenInformation GetSecurityDescriptorSacl GetLengthSid CopySid AddAccessAllowedAce OpenThreadToken OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCloseKey

shlwapi

PathFileExistsW PathFindFileNameW PathAppendW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WinVerifyTrust

Name

.text

Size

359KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

761007e13b7bfbd67f02b9087b52c5efa83e5a6aa2186f3882b2b6dffbd61ce7

rpcrt4

kernel32

user32

shell32

ole32

oleaut32

advapi32

shlwapi

version

wtsapi32

userenv

crypt32

wintrust

generic