b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff

Sharing

Copy URL Twitter E-mail

General

Target
b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff
Size 130KB
Sample260726-3bgd7ssflb
SHA256 b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff
MD5 555662b98b9c77afbf01310e7da90c63
SHA1 fafaf938d74cdcc42e9c992a0d6284ce3990aacb
SHA512 f20e2a77c54ab6facbbb9f7e396bac30d4b85388673d1880c7386e53e6dc2690dfd67c27fe58df71f59fbbd0418263c86577fa927379a87fffd9c4de187548d2
SSDEEP 3072:bnnNzA/9qVvHHL/Ci8YxBkDf6YipfGkEqzXDyM5HeU:TNzA/9qRHr/C4xaD6LEqzE
TLSH
T132D34A47B7A840B6D0678139C9934A85EBB3BC450B6153CF6728A75E2F337D1AD3A321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff

File Explorer

b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff

.dll 130KB

b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff

IMPHASH 729031003cd411d64e609d180558e6d3
SHA256 b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff
MD5 555662b98b9c77afbf01310e7da90c63
SHA1 fafaf938d74cdcc42e9c992a0d6284ce3990aacb
SHA512 f20e2a77c54ab6facbbb9f7e396bac30d4b85388673d1880c7386e53e6dc2690dfd67c27fe58df71f59fbbd0418263c86577fa927379a87fffd9c4de187548d2
SSDEEP 3072:bnnNzA/9qVvHHL/Ci8YxBkDf6YipfGkEqzXDyM5HeU:TNzA/9qRHr/C4xaD6LEqzE
TLSH
T132D34A47B7A840B6D0678139C9934A85EBB3BC450B6153CF6728A75E2F337D1AD3A321
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle UnmapViewOfFile MapViewOfFile OpenFileMappingW GetCurrentProcessId InitializeCriticalSection DeleteCriticalSection LoadLibraryW SetLastError LocalFree LocalAlloc OutputDebugStringW WideCharToMultiByte GetSystemDirectoryW Sleep GetVersionExW FlushFileBuffers GetThreadLocale SetThreadLocale LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary GetModuleFileNameW lstrcmpiW WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount LoadLibraryA GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException CreateFileA lstrlenW GetACP GetCPInfo HeapSize FlsAlloc HeapAlloc HeapFree RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx GetSystemTimeAsFileTime HeapReAlloc GetCurrentThreadId FlsSetValue GetCommandLineA ExitProcess WriteFile GetStdHandle GetModuleFileNameA HeapSetInformation HeapCreate HeapDestroy TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext EncodePointer DecodePointer FlsGetValue FlsFree

user32

EmptyClipboard CharNextW OpenClipboard CloseClipboard

advapi32

RegEnumKeyExW RegDeleteValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegDeleteKeyW

ole32

CoTaskMemFree StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc

oleaut32

RegisterTypeLi SysStringLen SysFreeString SysAllocString UnRegisterTypeLi VarUI4FromStr VariantInit VariantClear DispCallFunc LoadRegTypeLi LoadTypeLi

rpcrt4

IUnknown_AddRef_Proxy NdrOleAllocate NdrOleFree NdrStubForwardingFunction IUnknown_QueryInterface_Proxy NdrDllCanUnloadNow NdrCStdStubBuffer2_Release NdrDllRegisterProxy NdrDllUnregisterProxy NdrDllGetClassObject IUnknown_Release_Proxy

crypt32

CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptMsgClose CryptQueryObject

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b1d79b8f52411b547c7bb4dab7c4517e308f897efdb6fc9aa033264ec0672bff

kernel32

user32

advapi32

ole32

oleaut32

rpcrt4

crypt32

version

generic