88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f

Sharing

Copy URL Twitter E-mail

General

Target
88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f
Size 482KB
Sample260727-keyhsabr2t
SHA256 88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f
MD5 4cd156b9136cb996ca7c0af1f341ef54
SHA1 2ed7ee012f92bbc8a1c26ebff21837405b9f3c80
SHA512 0d4351aea121ca574aae0b4f46bf5fbdcfb1150cf27ac39da4dd0d7440a9d894e9f1b966e9e36999a9688a4004fcb6d2a0617525f46ca9e03cbe06dde2b8ee73
SSDEEP 12288:HQO4658YxcfPc2brSWSNbwiqL+eqvUjvJ40dT:HQO4NygFrwqLjgUjvJ4ET
TLSH
T157A45B10B641D131F4BF58B58EBD45AE923C7960071C64EBA3C8592F4EF19E27B31A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f

File Explorer

88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f

.dll 482KB

88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f

IMPHASH dea5fa12f4eb4b5e664bb64b9766bd03
SHA256 88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f
MD5 4cd156b9136cb996ca7c0af1f341ef54
SHA1 2ed7ee012f92bbc8a1c26ebff21837405b9f3c80
SHA512 0d4351aea121ca574aae0b4f46bf5fbdcfb1150cf27ac39da4dd0d7440a9d894e9f1b966e9e36999a9688a4004fcb6d2a0617525f46ca9e03cbe06dde2b8ee73
SSDEEP 12288:HQO4658YxcfPc2brSWSNbwiqL+eqvUjvJ40dT:HQO4NygFrwqLjgUjvJ4ET
TLSH
T157A45B10B641D131F4BF58B58EBD45AE923C7960071C64EBA3C8592F4EF19E27B31A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

222702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Project\dtl_dep\PC\driverthelife8\trunk\DtlAutoSetup\trunk\project\Release\DtlAutoSetup.pdb

kernel32

HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap CreateMutexW ReleaseMutex GetSystemInfo GetVersionExW CreateDirectoryW GetModuleHandleA FindFirstFileA FindNextFileA OpenProcess GetCurrentProcessId MultiByteToWideChar SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetTickCount CreateFileW GetFileSize ReadFile WideCharToMultiByte GetSystemDirectoryW GetCurrentProcess Sleep SetEvent CreateEventW TerminateThread CreateThread CreateFileMappingW MapViewOfFile UnmapViewOfFile FindClose GetModuleFileNameA GetSystemWindowsDirectoryW QueryPerformanceCounter GetTempFileNameW MoveFileExW CopyFileW GetWindowsDirectoryW ResumeThread TerminateProcess CreateJobObjectW AssignProcessToJobObject QueryInformationJobObject TerminateJobObject InitializeCriticalSectionAndSpinCount RaiseException DecodePointer DeleteCriticalSection GetSystemDefaultLCID FindNextFileW FindFirstFileW lstrlenW GetTempPathW CloseHandle GetExitCodeProcess WaitForSingleObject LocalAlloc WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA SetStdHandle LocalFree GetModuleHandleW LoadLibraryExW GetLastError CreateProcessW LoadLibraryW GetModuleFileNameW FreeLibrary GetProcAddress CreateFileA ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP ExitProcess SetEndOfFile GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers EncodePointer EnterCriticalSection LeaveCriticalSection SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeCriticalSection SetFilePointer InterlockedExchange DeleteFileA GetLocalTime GetCurrentThreadId WriteFile FormatMessageA ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead GetStdHandle

user32

wsprintfW GetWindowTextW GetParent EnumWindows SendMessageW GetClientRect EnumChildWindows FindWindowExW GetWindowThreadProcessId IsWindow FindWindowW PostMessageW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW SetNamedSecurityInfoW

shell32

ShellExecuteExW SHFileOperationW

shlwapi

StrStrIW PathAppendA PathFileExistsA PathIsDirectoryW PathFileExistsW PathAppendW PathRemoveFileSpecW PathRemoveFileSpecA

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

psapi

GetModuleFileNameExW GetModuleBaseNameW EnumProcessModules

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Name

.text

Size

342KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

88c588276e180a369bb55d44b7d5fbc791007c114b43605521215b4ccaa9332f

kernel32

user32

advapi32

shell32

shlwapi

setupapi

psapi

version

generic