3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8

Sharing

Copy URL Twitter E-mail

General

Target
3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8
Size 388KB
Sample260728-ref23ahf39
SHA256 3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8
MD5 89fac5ce0310a89c4185715320d4cbbc
SHA1 21229a25fe8d5248a74851764997dde3ab065627
SHA512 6c7003bd1fb3f9ad6d03f515a129b56a002acbaaa1930eca60a7cfb6a37d636f87e759f17038f1a2fe18d0bad46676974a1654c824aadf3d530889e069216e17
SSDEEP 3072:bZ3UFbN6XP22wvVJbrR33N9KqN/41lAkdAHAfvr01Ge9vbMUEFZWwpx4aDOS5m:br/clrR3DKqNg1lAkdAHIkMUEDT1OS5m
TLSH
T114840740F6A06867E57BC33944D7E32537B87A51775BDF178A082D2C1A37BE32DA0A42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8

File Explorer

3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8

.dll 388KB

3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8

IMPHASH bb12da4f0c15df6a02539f388f4b45f2
SHA256 3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8
MD5 89fac5ce0310a89c4185715320d4cbbc
SHA1 21229a25fe8d5248a74851764997dde3ab065627
SHA512 6c7003bd1fb3f9ad6d03f515a129b56a002acbaaa1930eca60a7cfb6a37d636f87e759f17038f1a2fe18d0bad46676974a1654c824aadf3d530889e069216e17
SSDEEP 3072:bZ3UFbN6XP22wvVJbrR33N9KqN/41lAkdAHAfvr01Ge9vbMUEFZWwpx4aDOS5m:br/clrR3DKqNg1lAkdAHIkMUEDT1OS5m
TLSH
T114840740F6A06867E57BC33944D7E32537B87A51775BDF178A082D2C1A37BE32DA0A42
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx

gdi32

CreateFontIndirectW GetObjectW GetStockObject LineTo MoveToEx SelectObject SetDCPenColor

kernel32

DisableThreadLibraryCalls EnumResourceNamesW ExpandEnvironmentStringsW FindResourceW GetEnvironmentVariableW GetFileAttributesW GetFullPathNameW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte lstrcmpW lstrcmpiW

ntdll

_vsnprintf

ole32

CoCreateInstance OleCreate OleInitialize OleSetContainedObject OleUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

PathCombineW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _strdup _stricmp _strnicmp _wcsdup _wcsnicmp atoi calloc free fwrite getenv isspace malloc memchr memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen strncmp strstr strtol tolower wcschr wcslen wcsrchr wcsstr

user32

BeginPaint ClientToScreen CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EndPaint FrameRect GetClientRect GetDesktopWindow GetMessageW GetParent GetSubMenu GetSysColor GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextA LoadBitmapW LoadCursorW LoadIconW LoadMenuW LoadStringW MoveWindow PostQuitMessage RegisterClassExW ReleaseCapture SendMessageW SetCapture SetMenuItemInfoW SetWindowLongW SetWindowPos ShowWindow TrackPopupMenu TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

72KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

259B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3083e291f9b289625d1f1950694d5c9e9e9d8d4712dc9af1a3d2a70ae57dafb8

comctl32

gdi32

kernel32

ntdll

ole32

oleaut32

shlwapi

ucrtbase

user32

generic