63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509

Sharing

Copy URL Twitter E-mail

General

Target
63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509
Size 983KB
Sample260728-rf5rtaaq91
SHA256 63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509
MD5 e4a79415f1694a6e272c72598339225c
SHA1 92e139b531ad60c2bdbc1288e2ea5219d57345b3
SHA512 60c05cccc6ccdf270459c75959a2dd0388c2ee9b004767823387f6944c2c0d8ef3de4f449b4d0df7271b43850ea47dd39222052170ac38d009ff744827b05e01
SSDEEP 12288:c3cm6eEGcsR+5X7/oX+D6Cii8ZUThmdps:cMm6ec0wX7/oX+P3hmdps
TLSH
T10425F805E3EA5861F5F3AF7049BEE63E4B3EBE618832CD5F56145A4C1D32E909960323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509

File Explorer

63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509

.dll 983KB

63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509

IMPHASH 3c9363c4b3df278ebb925cc2cea29293
SHA256 63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509
MD5 e4a79415f1694a6e272c72598339225c
SHA1 92e139b531ad60c2bdbc1288e2ea5219d57345b3
SHA512 60c05cccc6ccdf270459c75959a2dd0388c2ee9b004767823387f6944c2c0d8ef3de4f449b4d0df7271b43850ea47dd39222052170ac38d009ff744827b05e01
SSDEEP 12288:c3cm6eEGcsR+5X7/oX+D6Cii8ZUThmdps:cMm6ec0wX7/oX+P3hmdps
TLSH
T10425F805E3EA5861F5F3AF7049BEE63E4B3EBE618832CD5F56145A4C1D32E909960323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

395712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextA CryptAcquireContextW CryptContextAddRef CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyHash CryptDestroyKey CryptEncrypt CryptEnumProvidersW CryptExportKey CryptGenKey CryptGenRandom CryptGetHashParam CryptGetKeyParam CryptGetProvParam CryptGetUserKey CryptHashData CryptImportKey CryptReleaseContext CryptSetProvParam CryptSignHashW CryptVerifySignatureW GetUserNameA RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyExW RegCreateKeyW RegDeleteKeyA RegDeleteKeyW RegDeleteTreeW RegEnumKeyA RegEnumKeyExW RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptVerifySignature

kernel32

CloseHandle CompareFileTime CreateFileA CreateFileW CreateSemaphoreW DelayLoadFailureHook DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FreeLibrary GetDateFormatA GetFileSize GetLocaleInfoA GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount HeapAlloc HeapReAlloc InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree MultiByteToWideChar RaiseException ReadFile ReleaseSemaphore ResolveDelayLoadedAPI RtlUnwind SetFilePointer SetFilePointerEx SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpA lstrcmpiW

ntdll

NtQueryVirtualMemory RtlNtStatusToDosError _vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _strdup _stricmp _strnicmp _wcsicmp _wcslwr _wcsnicmp free fwrite getenv isspace iswspace malloc memchr memcmp memcpy memmove memset qsort realloc strchr strcmp strcpy strcspn strlen strncmp strstr strtol towlower wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr

user32

CharNextA LoadStringW wsprintfW

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddCertificateLinkToStore CertAddEncodedCRLToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertAddEncodedCertificateToSystemStoreA CertAddEncodedCertificateToSystemStoreW CertAddEnhancedKeyUsageIdentifier CertAddSerializedElementToStore CertAddStoreToCollection CertAlgIdToOID CertCloseStore CertCompareCertificate CertCompareCertificateName CertCompareIntegerBlob CertComparePublicKeyInfo CertControlStore CertCreateCRLContext CertCreateCTLContext CertCreateCertificateChainEngine CertCreateCertificateContext CertCreateContext CertCreateSelfSignCertificate CertDeleteCRLFromStore CertDeleteCTLFromStore CertDeleteCertificateFromStore CertDuplicateCRLContext CertDuplicateCTLContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCRLContextProperties CertEnumCRLsInStore CertEnumCTLContextProperties CertEnumCTLsInStore CertEnumCertificateContextProperties CertEnumCertificatesInStore CertEnumPhysicalStore CertEnumSystemStore CertFindAttribute CertFindCRLInStore CertFindCTLInStore CertFindCertificateInCRL CertFindCertificateInStore CertFindChainInStore CertFindExtension CertFindRDNAttr CertFindSubjectInCTL CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCRLContextProperty CertGetCRLFromStore CertGetCTLContextProperty CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertGetIssuerCertificateFromStore CertGetNameStringA CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetSubjectCertificateFromStore CertGetValidUsages CertIsRDNAttrsInCertificateName CertIsValidCRLForCertificate CertNameToStrA CertNameToStrW CertOIDToAlgId CertOpenStore CertOpenSystemStoreA CertOpenSystemStoreW CertRDNValueToStrA CertRDNValueToStrW CertRegisterPhysicalStore CertRegisterSystemStore CertRemoveEnhancedKeyUsageIdentifier CertRemoveStoreFromCollection CertSaveStore CertSerializeCRLStoreElement CertSerializeCTLStoreElement CertSerializeCertificateStoreElement CertSetCRLContextProperty CertSetCTLContextProperty CertSetCertificateContextProperty CertSetEnhancedKeyUsage CertSetStoreProperty CertStrToNameA CertStrToNameW CertUnregisterPhysicalStore CertUnregisterSystemStore CertVerifyCRLRevocation CertVerifyCRLTimeValidity CertVerifyCTLUsage CertVerifyCertificateChainPolicy CertVerifyRevocation CertVerifySubjectCertificateContext CertVerifyTimeValidity CertVerifyValidityNesting CreateFileU CryptAcquireCertificatePrivateKey CryptAcquireContextU CryptBinaryToStringA CryptBinaryToStringW CryptCloseAsyncHandle CryptCreateAsyncHandle CryptDecodeMessage CryptDecodeObject CryptDecodeObjectEx CryptDecryptAndVerifyMessageSignature CryptDecryptMessage CryptEncodeObject CryptEncodeObjectEx CryptEncryptMessage CryptEnumOIDFunction CryptEnumOIDInfo CryptEnumProvidersU CryptExportPKCS8 CryptExportPublicKeyInfo CryptExportPublicKeyInfoEx CryptFindCertificateKeyProvInfo CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptFreeOIDFunctionAddress CryptGetAsyncParam CryptGetDefaultOIDDllList CryptGetDefaultOIDFunctionAddress CryptGetMessageCertificates CryptGetMessageSignerCount CryptGetOIDFunctionAddress CryptGetOIDFunctionValue CryptHashCertificate CryptHashCertificate2 CryptHashMessage CryptHashPublicKeyInfo CryptHashToBeSigned CryptImportPKCS8 CryptImportPublicKeyInfo CryptImportPublicKeyInfoEx CryptImportPublicKeyInfoEx2 CryptInitOIDFunctionSet CryptInstallOIDFunctionAddress CryptLoadSip CryptMemAlloc CryptMemFree CryptMemRealloc CryptMsgCalculateEncodedLength CryptMsgClose CryptMsgControl CryptMsgCountersign CryptMsgCountersignEncoded CryptMsgDuplicate CryptMsgEncodeAndSignCTL CryptMsgGetAndVerifySigner CryptMsgGetParam CryptMsgOpenToDecode CryptMsgOpenToEncode CryptMsgSignCTL CryptMsgUpdate CryptMsgVerifyCountersignatureEncoded CryptMsgVerifyCountersignatureEncodedEx CryptProtectData CryptProtectMemory CryptQueryObject CryptRegisterDefaultOIDFunction CryptRegisterOIDFunction CryptRegisterOIDInfo CryptSIPAddProvider CryptSIPCreateIndirectData CryptSIPGetSignedDataMsg CryptSIPLoad CryptSIPPutSignedDataMsg CryptSIPRemoveProvider CryptSIPRemoveSignedDataMsg CryptSIPRetrieveSubjectGuid CryptSIPRetrieveSubjectGuidForCatalogFile CryptSIPVerifyIndirectData CryptSetAsyncParam CryptSetKeyIdentifierProperty CryptSetOIDFunctionValue CryptSetProviderU CryptSignAndEncodeCertificate CryptSignAndEncryptMessage CryptSignCertificate CryptSignHashU CryptSignMessage CryptSignMessageWithKey CryptStringToBinaryA CryptStringToBinaryW CryptUnprotectData CryptUnprotectMemory CryptUnregisterDefaultOIDFunction CryptUnregisterOIDFunction CryptUnregisterOIDInfo CryptVerifyCertificateSignature CryptVerifyCertificateSignatureEx CryptVerifyDetachedMessageHash CryptVerifyDetachedMessageSignature CryptVerifyMessageHash CryptVerifyMessageSignature CryptVerifyMessageSignatureWithKey CryptVerifySignatureU I_CertUpdateStore I_CryptAllocTls I_CryptCreateLruCache I_CryptCreateLruEntry I_CryptDetachTls I_CryptFindLruEntry I_CryptFindLruEntryData I_CryptFlushLruCache I_CryptFreeLruCache I_CryptFreeTls I_CryptGetAsn1Decoder I_CryptGetAsn1Encoder I_CryptGetDefaultCryptProv I_CryptGetDefaultCryptProvForEncrypt I_CryptGetOssGlobal I_CryptGetTls I_CryptInsertLruEntry I_CryptInstallAsn1Module I_CryptInstallOssGlobal I_CryptReadTrustedPublisherDWORDValueFromRegistry I_CryptReleaseLruEntry I_CryptSetTls I_CryptUninstallAsn1Module I_CryptUninstallOssGlobal PFXExportCertStore PFXExportCertStoreEx PFXImportCertStore PFXIsPFXBlob PFXVerifyPassword RegCreateHKCUKeyExU RegCreateKeyExU RegDeleteValueU RegEnumValueU RegOpenHKCUKeyExU RegOpenKeyExU RegQueryInfoKeyU RegQueryValueExU RegSetValueExU

Name

.text

Size

388KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

64KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

276KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

63d308341d55bca3320f6a3d505e10a12c5e8d8b7f784c95108c9e37c0924509

advapi32

bcrypt

kernel32

ntdll

ucrtbase

user32

generic