ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1

Sharing

Copy URL Twitter E-mail

General

Target
ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1
Size 1.0MB
Sample260729-bcd7padc34
SHA256 ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1
MD5 15fef71b1fbeccbde5a2408fba21b89f
SHA1 50838ab74fe9f3b40de55511dd26e6124fb40737
SHA512 cf70571fed1d475eb93d26cc9fa2cf8a822b10143cc93abcb0fea52607e9e2ff857c1d2681e56b8807abc7aaa17e8a2b367cf7bde567ad1f8c62a453119ffe23
SSDEEP 6144:/yK4/BXbdhOgeCIoLbKNQ6EdMLBukkPP789mS:/n43hbIoL6gkk3u
TLSH
T1F5356221E3ED8A06F6F3AB3C6DB952511E36BDA5AE34CA4F0601265D08F0E94DD74723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1

File Explorer

ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1

.dll 1.0MB

ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1

IMPHASH 2f1152304935bf75a3c21dcd1e92ec99
SHA256 ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1
MD5 15fef71b1fbeccbde5a2408fba21b89f
SHA1 50838ab74fe9f3b40de55511dd26e6124fb40737
SHA512 cf70571fed1d475eb93d26cc9fa2cf8a822b10143cc93abcb0fea52607e9e2ff857c1d2681e56b8807abc7aaa17e8a2b367cf7bde567ad1f8c62a453119ffe23
SSDEEP 6144:/yK4/BXbdhOgeCIoLbKNQ6EdMLBukkPP789mS:/n43hbIoL6gkk3u
TLSH
T1F5356221E3ED8A06F6F3AB3C6DB952511E36BDA5AE34CA4F0601265D08F0E94DD74723
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

crypt32

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddStoreToCollection CertCloseStore CertCreateCertificateChainEngine CertDeleteCertificateFromStore CertDuplicateCertificateContext CertEnumCRLsInStore CertEnumCTLsInStore CertEnumCertificatesInStore CertEnumSystemStore CertFindExtension CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetValidUsages CertNameToStrW CertOpenStore CertOpenSystemStoreW CertRDNValueToStrW CertSaveStore CertSetCertificateContextProperty CertSetEnhancedKeyUsage CryptBinaryToStringA CryptDecodeObjectEx CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptQueryObject PFXExportCertStore

ole32

CreateBindCtx OleCreateDefaultHandler

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_SetBkColor PropertySheetW

comdlg32

GetOpenFileNameW GetSaveFileNameW

user32

DialogBoxParamW EnableWindow EndDialog EnumChildWindows GetClassLongW GetDC GetDlgItem GetParent GetWindowLongPtrW GetWindowRect IsDlgButtonChecked LoadBitmapW LoadImageW LoadStringW MapWindowPoints MessageBoxW PostMessageW ReleaseDC SendMessageA SendMessageW SetFocus SetWindowLongPtrW SetWindowPos ShowScrollBar ShowWindow

gdi32

CreateFontW DeleteObject GetDeviceCaps

advapi32

CryptAcquireContextW CryptDestroyKey CryptGetKeyParam CryptGetUserKey CryptReleaseContext CryptSetProvParam RegCloseKey RegCreateKeyExW RegDeleteValueA RegQueryValueExA RegSetValueExA

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp calloc free fwrite getenv iswprint iswspace malloc memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen wcslen wcsrchr

kernel32

CloseHandle CompareFileTime CreateFileW DelayLoadFailureHook DisableThreadLibraryCalls EnumResourceNamesW FileTimeToSystemTime FindResourceW FormatMessageW FreeLibrary GetDateFormatW GetEnvironmentVariableW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource LocalFree MulDiv MultiByteToWideChar RaiseException ResolveDelayLoadedAPI SizeofResource WriteFile lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

72KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

888KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ad3aab6d5820e68101ff0a7d4096ef233145eaea1060512a85fc2ea8a62ee5f1

crypt32

ole32

comctl32

comdlg32

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic