b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84

Sharing

Copy URL Twitter E-mail

General

Target
b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84
Size 1.7MB
Sample260728-rfwtxahf49
SHA256 b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84
MD5 cbc6adf93df9cc7d7e61563cad0b845f
SHA1 98c11d77a6d783ea4a901f2f08daf6a1ae5871a9
SHA512 65889c973f1855fa9f244f1cbe91574118ec7f555db3f6f2295ca1c67898b70e88fbb42569382477b96951d5776852d8aa32e8fc6c8fa3a3cafc804c02e6b936
SSDEEP 49152:l/alhLkXgqX8ZEdjWRLb+/31PzXrSEFzZR:lijkXgy/3Bnzz
TLSH
T166852944F617A8F2E922963405CEE37F1B387E60D2578F43EE147E996D33AE12985312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84

File Explorer

b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84

.dll 1.7MB

b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84

IMPHASH c77ec2b9ff1f05559879e2eb50dd1670
SHA256 b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84
MD5 cbc6adf93df9cc7d7e61563cad0b845f
SHA1 98c11d77a6d783ea4a901f2f08daf6a1ae5871a9
SHA512 65889c973f1855fa9f244f1cbe91574118ec7f555db3f6f2295ca1c67898b70e88fbb42569382477b96951d5776852d8aa32e8fc6c8fa3a3cafc804c02e6b936
SSDEEP 49152:l/alhLkXgqX8ZEdjWRLb+/31PzXrSEFzZR:lijkXgy/3Bnzz
TLSH
T166852944F617A8F2E922963405CEE37F1B387E60D2578F43EE147E996D33AE12985312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

776128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegOpenKeyA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW

gdi32

BitBlt CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreatePatternBrush CreatePen CreatePenIndirect CreatePolygonRgn CreateRectRgn CreateRectRgnIndirect CreateRoundRectRgn CreateSolidBrush DPtoLP DeleteDC DeleteObject ExcludeClipRect ExtCreatePen ExtCreateRegion ExtSelectClipRgn ExtTextOutW FillRgn FrameRgn GdiAlphaBlend GdiGetCharDimensions GdiGetCodePage GetBkColor GetBkMode GetCharABCWidthsW GetCharWidthInfo GetCharWidthW GetClipBox GetClipRgn GetCurrentObject GetDIBColorTable GetDIBits GetDeviceCaps GetLayout GetNearestColor GetObjectType GetObjectW GetPixel GetStockObject GetTextCharsetInfo GetTextColor GetTextExtentExPointW GetTextExtentPoint32A GetTextExtentPoint32W GetTextExtentPointA GetTextExtentPointW GetTextMetricsW IntersectClipRect LineTo MoveToEx OffsetWindowOrgEx PatBlt PlayEnhMetaFile PolyPolyline Polygon RectVisible Rectangle ScriptBreak ScriptStringAnalyse ScriptStringCPtoX ScriptStringFree ScriptStringGetLogicalWidths ScriptStringOut ScriptStringXtoCP ScriptString_pSize ScriptString_pcOutChars SelectClipRgn SelectObject SelectPalette SetBkColor SetBkMode SetDIBColorTable SetDIBits SetPixel SetPolyFillMode SetRectRgn SetTextAlign SetTextColor SetViewportOrgEx SetWindowOrgEx StretchBlt StretchDIBits TextOutW

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext ImmSetCompositionFontW ImmSetCompositionWindow

kernel32

DelayLoadFailureHook FindResourceA GetModuleHandleW GlobalAddAtomW GlobalDeleteAtom GlobalLock GlobalUnlock IsBadCodePtr IsBadStringPtrA IsBadStringPtrW IsBadWritePtr LocalSize RaiseException ResolveDelayLoadedAPI RtlUnwind

kernelbase

CloseHandle CompareFileTime CompareStringA CompareStringW CreateEventW CreateThread DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceW FreeResource GetDateFormatW GetDriveTypeW GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetProcAddress GetThreadLocale GetTickCount GetUserDefaultLCID GetVersion GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsValidLocale LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalLock LocalReAlloc LocalUnlock LockResource MulDiv MultiByteToWideChar SetEvent SizeofResource StrCmpIW StrCmpNIW SystemTimeToFileTime WaitForSingleObject WideCharToMultiByte lstrcmpW lstrcmpiW

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _assert _strdup _wcsdup _wcsicmp _wcsnicmp free fwrite getenv isprint iswalnum memcmp memcpy memmove memset qsort strcat strchr strcmp strcpy strcspn strlen wcschr wcsncmp wcsrchr wcsstr wcstol

user32

AdjustWindowRect AdjustWindowRectEx AppendMenuW BeginDeferWindowPos BeginPaint CallWindowProcA CallWindowProcW CharLowerBuffW CharLowerW CharUpperBuffW CharUpperW CheckMenuItem ChildWindowFromPoint ClientToScreen CloseClipboard CopyIcon CopyImage CopyRect CreateCaret CreateDialogIndirectParamA CreateDialogIndirectParamW CreateIconIndirect CreatePopupMenu CreateWindowExA CreateWindowExW DefWindowProcW DeferWindowPos DeleteMenu DestroyCaret DestroyCursor DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DialogBoxParamW DispatchMessageW DragDetect DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawStateW DrawTextA DrawTextW EmptyClipboard EnableMenuItem EnableScrollBar EnableWindow EndDeferWindowPos EndDialog EndPaint EnumChildWindows FillRect FrameRect GetActiveWindow GetAsyncKeyState GetCapture GetCaretPos GetClassLongW GetClassNameW GetClientRect GetClipboardData GetCursorPos GetDC GetDCEx GetDesktopWindow GetDlgCtrlID GetDlgItem GetDoubleClickTime GetDpiForWindow GetFocus GetIconInfo GetKeyNameTextW GetKeyState GetMenuState GetMessagePos GetMessageTime GetMessageW GetMonitorInfoW GetNextDlgGroupItem GetNextDlgTabItem GetParent GetPropW GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowLongW GetWindowRect GetWindowRgn GetWindowTextA GetWindowTextLengthA GetWindowTextLengthW GetWindowTextW InternalGetWindowText IntersectRect InvalidateRect InvalidateRgn InvertRect IsChild IsClipboardFormatAvailable IsDialogMessageW IsWindow IsWindowEnabled IsWindowUnicode IsWindowVisible KillSystemTimer KillTimer LoadBitmapW LoadCursorW LoadIconW LoadImageA LoadImageW LoadMenuA LoadStringW MapDialogRect MapVirtualKeyW MapWindowPoints MonitorFromRect MonitorFromWindow MoveWindow NotifyWinEvent OpenClipboard PeekMessageW PostMessageW PostQuitMessage RedrawWindow RegisterClassW RegisterWindowMessageW ReleaseCapture ReleaseDC RemovePropW ScreenToClient ScrollWindow ScrollWindowEx SendDlgItemMessageW SendMessageA SendMessageW SetCapture SetCaretPos SetClipboardData SetCursor SetFocus SetParent SetPropW SetScrollInfo SetScrollPos SetScrollRange SetSystemTimer SetTimer SetWindowLongA SetWindowLongW SetWindowPos SetWindowRgn SetWindowTextA SetWindowTextW ShowCaret ShowScrollBar ShowWindow SubtractRect SystemParametersInfoW TabbedTextOutW TrackMouseEvent TrackPopupMenu TranslateMessage UnionRect UnregisterClassA UnregisterClassW UpdateWindow WindowFromPoint wsprintfW

AddMRUStringW CreateMRUListW CreateMappedBitmap CreatePropertySheetPage CreatePropertySheetPageA CreatePropertySheetPageW CreateStatusWindow CreateStatusWindowA CreateStatusWindowW CreateToolbar CreateToolbarEx CreateUpDownControl DPA_Clone DPA_Create DPA_CreateEx DPA_DeleteAllPtrs DPA_DeletePtr DPA_Destroy DPA_DestroyCallback DPA_EnumCallback DPA_GetPtr DPA_GetPtrIndex DPA_GetSize DPA_Grow DPA_InsertPtr DPA_Search DPA_SetPtr DPA_Sort DSA_Clone DSA_Create DSA_DeleteAllItems DSA_DeleteItem DSA_Destroy DSA_DestroyCallback DSA_EnumCallback DSA_GetItem DSA_GetItemPtr DSA_GetSize DSA_InsertItem DSA_SetItem DefSubclassProc DestroyPropertySheetPage DllGetVersion DllInstall DrawInsert DrawShadowText DrawStatusText DrawStatusTextA DrawStatusTextW EnumMRUListW FlatSB_EnableScrollBar FlatSB_GetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollProp FlatSB_GetScrollRange FlatSB_SetScrollInfo FlatSB_SetScrollPos FlatSB_SetScrollProp FlatSB_SetScrollRange FlatSB_ShowScrollBar GetEffectiveClientRect GetMUILanguage GetWindowSubclass HIMAGELIST_QueryInterface ImageList_Add ImageList_AddIcon ImageList_AddMasked ImageList_BeginDrag ImageList_CoCreateInstance ImageList_Copy ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_DrawIndirect ImageList_Duplicate ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetFlags ImageList_GetIcon ImageList_GetIconSize ImageList_GetImageCount ImageList_GetImageInfo ImageList_GetImageRect ImageList_LoadImage ImageList_LoadImageA ImageList_LoadImageW ImageList_Merge ImageList_Read ImageList_Remove ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_SetFilter ImageList_SetFlags ImageList_SetIconSize ImageList_SetImageCount ImageList_SetOverlayImage ImageList_Write ImageList_WriteEx InitCommonControls InitCommonControlsEx InitMUILanguage InitializeFlatSB LBItemFromPt LoadIconMetric LoadIconWithScaleDown MakeDragList MenuHelp PropertySheet PropertySheetA PropertySheetW RegisterClassNameW RemoveWindowSubclass SetWindowSubclass ShowHideMenuCtl TaskDialog TaskDialogIndirect UninitializeFlatSB _TrackMouseEvent

Name

.text

Size

760KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

868B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

128KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

68KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

324KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b0e0eff2455713b3c8397fe12e4a0f99d3bcfeae417265be1d2970eaaa5b8c84

advapi32

gdi32

imm32

kernel32

kernelbase

ntdll

ucrtbase

user32

generic