70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775

General

Target
70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775
Size 2.6MB
Sample260724-aa131azake
SHA256 70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775
MD5 6c2f276ba8851b48354db2f49ef57e80
SHA1 0a682a81d461189d598695ddf3756dad92dd1695
SHA512 cb7c50a6f81f36274ff27d96bc82f56164d9f1acd04b82f9fc4264f70061dff948ef535da12325128da9c75ee6284cc87d610fcfb6cdd60ebc0906d8fcb38a48
SSDEEP 12288:xB1PLvjJtIGuYsl4wcxOSKyiG//87gRgYafcCxlNv//8G0pDdly8ECd9EgenPvq:xBfzml5c6yiHCPc/5vXL0pCC0gePvq
TLSH
T1E5C5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detects the extracted x64 multi-cryptocurrency clipboard hijacker payload. 1 IoCs

Detects the extracted x64 multi-cryptocurrency clipboard hijacker payload.

resource	yara_rule
sample	MAL_Win64_MultiCrypto_Clipboard_Hijacker_4e56d256

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775

File Explorer

70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775

.exe 2.6MB

70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775

IMPHASH 393d779b279452acafa3be6bafa76ebb
SHA256 70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775
MD5 6c2f276ba8851b48354db2f49ef57e80
SHA1 0a682a81d461189d598695ddf3756dad92dd1695
SHA512 cb7c50a6f81f36274ff27d96bc82f56164d9f1acd04b82f9fc4264f70061dff948ef535da12325128da9c75ee6284cc87d610fcfb6cdd60ebc0906d8fcb38a48
SSDEEP 12288:xB1PLvjJtIGuYsl4wcxOSKyiG//87gRgYafcCxlNv//8G0pDdly8ECd9EgenPvq:xBfzml5c6yiHCPc/5vXL0pCC0gePvq
TLSH
T1E5C5E28D775D41ACC56244B210F10A92A7B9DB16A3E85E071BC6CC788E120DDBBBDBF4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects the extracted x64 multi-cryptocurrency clipboard hijacker payload.

Detects the extracted x64 multi-cryptocurrency clipboard hijacker payload.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW

shell32

SHGetFolderPathW ShellExecuteW

kernel32

WriteConsoleW RtlCaptureContext GetConsoleMode lstrlenW WriteFile CreateMutexW CreateFileW ReleaseMutex GetLastError CloseHandle QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetConsoleOutputCP RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers

Name

.text

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

70705bce0d1386b78ed87f9fe71770106c31116195310837bff6f195451a1775

user32

advapi32

shell32

kernel32

generic