a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d

Sharing

Copy URL Twitter E-mail

General

Target
a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d
Size 9.2MB
Sample260723-vpfe3atbqa
SHA256 a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d
MD5 086917ce352ed134b4cb470c8408a547
SHA1 b52b911a494a8766beed9eecbac7a54d3b59370c
SHA512 2b6ee50a59d42bc146cf8a9328865ed153a9b91bc79c7814e5bf0241db59f4fdb9a75f0d8403d163c50a00db4ebaa931697258c24d508949122c49fa3494b85a
SSDEEP 98304:MbyejPVMVo4mTkQ/dxfh3P90IWFjyMUFQzsgkPAkIHfbH/VMV8M:2TgB2hOIujyFe88
TLSH
T10EA62A14B752C537D899017D82AE7B8F10BC0635B7AE0BEBAD90252B68F47D31835F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d

File Explorer

a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d

.exe 9.2MB

a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d

IMPHASH a29aac4d3b915834471781375c0cb660
SHA256 a4983244acd861c7e90e1e3b2b1c1116ab55eeee3465b32d5093d2d41e07ca5d
MD5 086917ce352ed134b4cb470c8408a547
SHA1 b52b911a494a8766beed9eecbac7a54d3b59370c
SHA512 2b6ee50a59d42bc146cf8a9328865ed153a9b91bc79c7814e5bf0241db59f4fdb9a75f0d8403d163c50a00db4ebaa931697258c24d508949122c49fa3494b85a
SSDEEP 98304:MbyejPVMVo4mTkQ/dxfh3P90IWFjyMUFQzsgkPAkIHfbH/VMV8M:2TgB2hOIujyFe88
TLSH
T10EA62A14B752C537D899017D82AE7B8F10BC0635B7AE0BEBAD90252B68F47D31835F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3446902

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualQuery LoadLibraryExW IsBadWritePtr GetTempFileNameW MoveFileA lstrcmpiA SetFilePointer FreeResource CompareStringA GetFullPathNameA InterlockedCompareExchange InitializeCriticalSection InterlockedExchange FindResourceA UnmapViewOfFile CreateFileMappingA GetFileSize MapViewOfFile GetModuleHandleA LoadLibraryA GetTempPathA GetTempFileNameA CreateFileA DeleteFileA OutputDebugStringA GetVersionExA lstrlenA VirtualFree VirtualAlloc InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead lstrcmpiW WriteConsoleW SetStdHandle FlushFileBuffers SetFilePointerEx GetConsoleCP ReadConsoleW GetConsoleMode FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleW SizeofResource SetCurrentDirectoryW HeapReAlloc GlobalHandle InterlockedIncrement FindResourceW LockResource LoadResource GlobalFree InterlockedDecrement GetDriveTypeW SetErrorMode HeapFree GlobalMemoryStatus GetVersionExW GetLocaleInfoW GetSystemDirectoryW GetProcessHeap HeapAlloc FreeLibrary GetProcAddress LoadLibraryW SetLastError Sleep GlobalUnlock GlobalLock MulDiv lstrcmpW GetCurrentProcess FlushInstructionCache GetCurrentThreadId GetModuleFileNameW DecodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetFileType LCMapStringW CompareStringW GetStringTypeW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCPInfo GetOEMCP IsValidCodePage WriteFile GetStdHandle GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSize AreFileApisANSI GetModuleHandleExW ReadFile RtlUnwind GetCommandLineW GetACP GetSystemTimeAsFileTime IsProcessorFeaturePresent IsDebuggerPresent EncodePointer OutputDebugStringW ExitThread GetTickCount InitializeCriticalSectionAndSpinCount GetLastError RaiseException MultiByteToWideChar GlobalAlloc ExitProcess LocalFree FormatMessageW FindClose FindNextFileW FindFirstFileW CreateProcessW DeleteFileW MoveFileW CopyFileW CreateFileW SetFileAttributesW GetFileAttributesW SetEndOfFile GetLocalTime GetFullPathNameW WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemInfo CreateSemaphoreW CloseHandle WaitForSingleObject ReleaseSemaphore CreateThread SetEnvironmentVariableA

user32

SetTimer EnumDisplaySettingsExW GetClientRect InvalidateRect ReleaseDC SendMessageW GetFocus SetCursorPos FillRect BeginPaint EndPaint GetSystemMetrics ClientToScreen ScreenToClient GetAsyncKeyState CharNextW UnregisterClassW SetWindowLongW GetWindowLongW CreateWindowExW DestroyWindow SetWindowTextW GetWindowTextW GetDC AdjustWindowRectEx ValidateRect LoadImageW UnhookWindowsHookEx SetWindowsHookExW CallNextHookEx SetDlgItemTextW SetCursor GetCursor CreateIconIndirect DestroyIcon FindWindowW DialogBoxIndirectParamW GetMessageW PeekMessageW IsIconic EnumDisplayDevicesW GetWindowPlacement GetCursorPos GetActiveWindow AdjustWindowRect EndDialog ChangeDisplaySettingsExW CallWindowProcW RegisterWindowMessageW DefWindowProcW ReleaseCapture CreateAcceleratorTableW GetDesktopWindow DestroyAcceleratorTable GetSysColor RegisterClassExW LoadCursorW GetClassInfoExW GetClassNameW IsWindow GetDlgItem GetParent IsChild GetWindow SetFocus SetCapture GetKeyState MessageBoxW WaitForInputIdle OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetWindowRect IsDialogMessageW TranslateMessage DispatchMessageW LoadIconW GetPropW SetPropW RemovePropW PostQuitMessage SetActiveWindow IsWindowEnabled SetClassLongW GetMenu SetMenu PostMessageW UpdateWindow MonitorFromPoint GetMonitorInfoW SystemParametersInfoW CreateDialogParamW CreateDialogIndirectParamW DialogBoxParamW ShowScrollBar CreateMenu DestroyMenu GetMenuItemCount InsertMenuItemW RemoveMenu CheckMenuItem GetMenuState CreatePopupMenu TrackPopupMenu EnableWindow RedrawWindow ShowWindow InvalidateRgn SetWindowPos MoveWindow GetWindowTextLengthW

gdi32

SetTextColor BitBlt CreateSolidBrush CreateCompatibleDC DeleteDC CreateFontIndirectW DeleteObject SetBkMode GetTextExtentPoint32W SelectObject TextOutW GetTextMetricsW EnumFontFamiliesExW GdiFlush CreateDIBSection AddFontResourceExW AddFontMemResourceEx SetStretchBltMode StretchBlt CreateBitmap GetDeviceCaps GetStockObject CreateCompatibleBitmap GetObjectW CreateFontW ExtTextOutW MoveToEx ExtTextOutA SetMapMode SetTextAlign CreateFontIndirectA GetFontLanguageInfo SetBkColor GetCharacterPlacementW GetCharacterPlacementA GetGlyphOutlineA GetTextMetricsA GetObjectA GetGlyphOutlineW

advapi32

RegOpenKeyExW RegQueryValueExA RegQueryValueExW GetUserNameA RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW CryptAcquireContextW CryptReleaseContext CryptDestroyHash CryptDestroyKey CryptEncrypt CryptDeriveKey CryptHashData CryptCreateHash RegOpenKeyA

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathW DragFinish DragQueryFileW ShellExecuteExW

ole32

CoTaskMemRealloc CoUninitialize CoInitialize CoSetProxyBlanket OleUninitialize OleInitialize OleLockRunning CoGetClassObject CLSIDFromProgID CreateStreamOnHGlobal CLSIDFromString CoTaskMemFree CoCreateInstance StringFromGUID2 CoTaskMemAlloc

oleaut32

SysAllocStringLen SysFreeString SysAllocString SysStringLen VariantInit VariantClear LoadTypeLi LoadRegTypeLi OleCreateFontIndirect VariantCopy VariantChangeType DispCallFunc VarUI4FromStr

winmm

mmioSetInfo mmioGetInfo mmioClose mmioSeek timeGetTime mciSendStringW mciGetErrorStringW timeGetDevCaps timeBeginPeriod timeEndPeriod mmioAscend mmioRead mmioDescend mmioOpenW mmioAdvance

comctl32

CreateStatusWindowW InitCommonControlsEx

dsound

ord3 ord1

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetConnectW InternetOpenW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

imm32

ImmAssociateContext

d3d9

Direct3DCreate9

comdlg32

GetOpenFileNameW GetSaveFileNameW

ws2_32

WSACleanup closesocket

Name

.text

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

673KB

Virtual Size

673KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

290KB

Virtual Size

67.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

347KB

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=15, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=6, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=154, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=9, id=225, version=20806,

count=1, id=199, version=41118,

count=84, id=223, productName=VS2013 build 21005, version=21005,

count=1, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=2, id=19, version=8034,

count=40, id=225, productName=VS2013 UPD3 build 30723, version=30723,

count=85, id=225, productName=VS2013 build 21005, version=21005,

count=249, id=224, productName=VS2013 build 21005, version=21005,

count=7, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=436, id=1, productName=Unmarked objects,

count=439, id=229, version=40629,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD5 build 40629, version=40629,