d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71

Sharing

Copy URL Twitter E-mail

General

Target
d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71
Size 3.6MB
Sample260728-weh9msaf63
SHA256 d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71
MD5 5f7b712085219c6450b927dcbb6d2a50
SHA1 e1c83085ee2ad07391769beb552ba6e8a0f12dd3
SHA512 6e4106142d32f1238a530594020390e10f7e22e9562bdb4a8b8808261297b88273d06f3235d6e9b5fe74c5c57c9d54e4baf4d42b966427c8e04a58ca8595f748
SSDEEP 49152:d2hXOXLizIzwF7DMWI48/IbfoXi/s5KPCRmRO:dJfzuzAqs5KPCRmRO
TLSH
T1C006EA42ADDB0DE5CEC26BB495D7123DA77CFD71891D5E275A08F6242E23AC06C2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71

File Explorer

d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71

.exe 3.6MB

d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71

IMPHASH 915a92ced106a12bdeb6d86f350821a6
SHA256 d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71
MD5 5f7b712085219c6450b927dcbb6d2a50
SHA1 e1c83085ee2ad07391769beb552ba6e8a0f12dd3
SHA512 6e4106142d32f1238a530594020390e10f7e22e9562bdb4a8b8808261297b88273d06f3235d6e9b5fe74c5c57c9d54e4baf4d42b966427c8e04a58ca8595f748
SSDEEP 49152:d2hXOXLizIzwF7DMWI48/IbfoXi/s5KPCRmRO:dJfzuzAqs5KPCRmRO
TLSH
T1C006EA42ADDB0DE5CEC26BB495D7123DA77CFD71891D5E275A08F6242E23AC06C2EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

DefSubclassProc ImageList_Create InitCommonControlsEx RemoveWindowSubclass SetWindowSubclass

comdlg32

GetOpenFileNameW

gdi32

CreateFontW CreatePen CreateSolidBrush DeleteObject Ellipse GetStockObject LineTo MoveToEx Rectangle RestoreDC RoundRect SaveDC SelectObject SetBkColor SetBkMode SetDCBrushColor SetDCPenColor SetTextColor

kernel32

CloseHandle CreateDirectoryA CreateEventA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageA FreeLibrary GetCPInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileInformationByHandle GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GlobalAlloc GlobalLock GlobalUnlock InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lseeki64 _read _setjmp _setmode _strdup _vscprintf _vsnprintf _wfopen _wfopen_s _write abort atexit calloc exit fclose fflush fopen fprintf fputc fputs fread free fseek ftell fwrite getenv isalnum iswctype localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strtol strtoul strxfrm towupper towlower vfprintf wcscoll wcsftime wcslen wcsxfrm

ole32

CoTaskMemFree

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteA

user32

CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EmptyClipboard GetClientRect GetCursorPos GetDlgItem GetMessageW GetParent GetWindow GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsWindow KillTimer LoadCursorW LoadIconW MessageBoxW MoveWindow OffsetRect OpenClipboard PostQuitMessage PtInRect RegisterClassW ScreenToClient SendMessageW SetClipboardData SetTimer SetWindowTextW ShowWindow TranslateMessage UpdateWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

74KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

366KB

Virtual Size

366KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

106KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

974B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d8533664a5bf5194b7e3b63a7e2109b85948f79a2dec17013b0b6b8f93785a71

comctl32

comdlg32

gdi32

kernel32

msvcrt

ole32

shell32

user32

winhttp

generic