663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe

Sharing

Copy URL Twitter E-mail

General

Target
663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe
Size 799KB
Sample260729-e437nsea64
SHA256 663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe
MD5 917726227f9dedfcc85e668866af4559
SHA1 348f234e2fdc96bddfec74fa62b5437a4ff2c8f8
SHA512 9d27baee9a87d9052ca607e800c85f98921ae27141dd5ccf716dec45407967205bd7b73ce553356ed29e7b0e1943b96cd8e84132b9cf5890a2c5b353673d49aa
SSDEEP 12288:HWouSjaJjk32N9cygnbFkHI1q8WEJ5m8CQ+abBblhJ9jm6dRg:Hu0skGYV15LJ/m6dRg
TLSH
T15205E891B3E91999E67693388AB743323B39FE814670CB5F6A04D6392C33ED0BD54721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe

File Explorer

663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe

.dll 799KB

663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe

IMPHASH d55e91a932f5c193b35d37e48b236d9d
SHA256 663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe
MD5 917726227f9dedfcc85e668866af4559
SHA1 348f234e2fdc96bddfec74fa62b5437a4ff2c8f8
SHA512 9d27baee9a87d9052ca607e800c85f98921ae27141dd5ccf716dec45407967205bd7b73ce553356ed29e7b0e1943b96cd8e84132b9cf5890a2c5b353673d49aa
SSDEEP 12288:HWouSjaJjk32N9cygnbFkHI1q8WEJ5m8CQ+abBblhJ9jm6dRg:Hu0skGYV15LJ/m6dRg
TLSH
T15205E891B3E91999E67693388AB743323B39FE814670CB5F6A04D6392C33ED0BD54721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CompareFileTime CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateSemaphoreW CreateThread DelayLoadFailureHook DeleteCriticalSection DeleteFileW DosDateTimeToFileTime EnterCriticalSection FileTimeToDosDateTime FileTimeToSystemTime FreeLibrary FreeLibraryAndExitThread GetComputerNameExA GetDateFormatA GetDiskFreeSpaceExA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetLocalTime GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetShortPathNameW GetSystemTime GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetTimeFormatA GlobalAlloc HeapAlloc HeapReAlloc IdnToAscii IdnToUnicode InitOnceExecuteOnce InitializeCriticalSectionEx IsBadReadPtr IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingW QueueUserWorkItem RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResolveDelayLoadedAPI RtlUnwind SetEndOfFile SetEvent SetFilePointer SetFilePointerEx SetThreadDescription Sleep SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile WaitForSingleObject WideCharToMultiByte WriteFile

mpr

WNetCachePassword WNetGetCachedPassword

ntdll

NtQuerySystemTime _vsnprintf

shell32

SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCreateFromUrlW PathMatchSpecW StrStrIA StrToInt64ExW UrlCanonicalizeA UrlCanonicalizeW UrlCombineA UrlCombineW UrlEscapeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _errno _ltow _strdup _stricmp _time64 _wcsdup _wcsicmp _wcsnicmp _wgetenv atoi atol calloc free fwrite getenv iswalnum iswalpha iswspace malloc memchr memcmp memcpy memmove memset qsort rand realloc strchr strcmp strcpy strcspn strlen strncmp strnlen strrchr strtok system towlower wcschr wcscmp wcscspn wcslen wcsncmp wcsnlen wcsrchr wcsspn wcsstr wcstol wcstoul

user32

CharLowerW DialogBoxParamW EndDialog GetDlgItem GetWindowLongPtrW GetWindowTextW LoadStringA LoadStringW SendMessageW SetWindowLongPtrW SetWindowTextW wsprintfW

ws2_32

accept bind closesocket connect getsockname getsockopt htons ioctlsocket listen recv select send setsockopt socket WSAGetLastError WSAStartup WSACleanup FreeAddrInfoW GetAddrInfoW freeaddrinfo getaddrinfo getnameinfo inet_ntop

CommitUrlCacheEntryA CommitUrlCacheEntryW CreateMD5SSOHash CreateUrlCacheContainerA CreateUrlCacheContainerW CreateUrlCacheEntryA CreateUrlCacheEntryW CreateUrlCacheGroup DeleteIE3Cache DeleteUrlCacheContainerA DeleteUrlCacheContainerW DeleteUrlCacheEntry DeleteUrlCacheEntryA DeleteUrlCacheEntryW DeleteUrlCacheGroup DeleteWpadCacheForNetworks DetectAutoProxyUrl DllInstall FindCloseUrlCache FindFirstUrlCacheContainerA FindFirstUrlCacheContainerW FindFirstUrlCacheEntryA FindFirstUrlCacheEntryExA FindFirstUrlCacheEntryExW FindFirstUrlCacheEntryW FindFirstUrlCacheGroup FindNextUrlCacheContainerA FindNextUrlCacheContainerW FindNextUrlCacheEntryA FindNextUrlCacheEntryExA FindNextUrlCacheEntryExW FindNextUrlCacheEntryW FindNextUrlCacheGroup ForceNexusLookup ForceNexusLookupExW FreeUrlCacheSpaceA FreeUrlCacheSpaceW FtpCommandA FtpCommandW FtpCreateDirectoryA FtpCreateDirectoryW FtpDeleteFileA FtpDeleteFileW FtpFindFirstFileA FtpFindFirstFileW FtpGetCurrentDirectoryA FtpGetCurrentDirectoryW FtpGetFileA FtpGetFileEx FtpGetFileSize FtpGetFileW FtpOpenFileA FtpOpenFileW FtpPutFileA FtpPutFileEx FtpPutFileW FtpRemoveDirectoryA FtpRemoveDirectoryW FtpRenameFileA FtpRenameFileW FtpSetCurrentDirectoryA FtpSetCurrentDirectoryW GetUrlCacheConfigInfoA GetUrlCacheConfigInfoW GetUrlCacheEntryInfoA GetUrlCacheEntryInfoExA GetUrlCacheEntryInfoExW GetUrlCacheEntryInfoW GetUrlCacheGroupAttributeA GetUrlCacheGroupAttributeW GetUrlCacheHeaderData GopherCreateLocatorA GopherCreateLocatorW GopherFindFirstFileA GopherFindFirstFileW GopherGetAttributeA GopherGetAttributeW GopherGetLocatorTypeA GopherGetLocatorTypeW GopherOpenFileA GopherOpenFileW HttpAddRequestHeadersA HttpAddRequestHeadersW HttpCheckDavCompliance HttpEndRequestA HttpEndRequestW HttpOpenRequestA HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestA HttpSendRequestExA HttpSendRequestExW HttpSendRequestW IncrementUrlCacheHeaderData InternetAlgIdToStringA InternetAlgIdToStringW InternetAttemptConnect InternetAutodial InternetAutodialCallback InternetAutodialHangup InternetCanonicalizeUrlA InternetCanonicalizeUrlW InternetCheckConnectionA InternetCheckConnectionW InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetCombineUrlA InternetCombineUrlW InternetConfirmZoneCrossing InternetConfirmZoneCrossingA InternetConfirmZoneCrossingW InternetConnectA InternetConnectW InternetCrackUrlA InternetCrackUrlW InternetCreateUrlA InternetCreateUrlW InternetDebugGetLocalTime InternetDial InternetDialA InternetDialW InternetEnumPerSiteCookieDecisionA InternetEnumPerSiteCookieDecisionW InternetErrorDlg InternetFindNextFileA InternetFindNextFileW InternetFortezzaCommand InternetGetCertByURL InternetGetCertByURLA InternetGetConnectedState InternetGetConnectedStateEx InternetGetConnectedStateExA InternetGetConnectedStateExW InternetGetCookieA InternetGetCookieExA InternetGetCookieExW InternetGetCookieW InternetGetLastResponseInfoA InternetGetLastResponseInfoW InternetGetPerSiteCookieDecisionA InternetGetPerSiteCookieDecisionW InternetGetSecurityInfoByURL InternetGetSecurityInfoByURLA InternetGetSecurityInfoByURLW InternetGoOnline InternetGoOnlineA InternetGoOnlineW InternetHangUp InternetInitializeAutoProxyDll InternetLockRequestFile InternetOpenA InternetOpenServerPushParse InternetOpenUrlA InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryFortezzaStatus InternetQueryOptionA InternetQueryOptionW InternetReadFile InternetReadFileExA InternetReadFileExW InternetSecurityProtocolToStringA InternetSecurityProtocolToStringW InternetServerPushParse InternetSetCookieA InternetSetCookieExA InternetSetCookieExW InternetSetCookieW InternetSetDialState InternetSetDialStateA InternetSetDialStateW InternetSetFilePointer InternetSetOptionA InternetSetOptionExA InternetSetOptionExW InternetSetOptionW InternetSetPerSiteCookieDecisionA InternetSetPerSiteCookieDecisionW InternetSetStatusCallback InternetSetStatusCallbackA InternetSetStatusCallbackW InternetShowSecurityInfoByURL InternetShowSecurityInfoByURLA InternetShowSecurityInfoByURLW InternetTimeFromSystemTime InternetTimeFromSystemTimeA InternetTimeFromSystemTimeW InternetTimeToSystemTime InternetTimeToSystemTimeA InternetTimeToSystemTimeW InternetUnlockRequestFile InternetWriteFile InternetWriteFileExA InternetWriteFileExW IsHostInProxyBypassList IsUrlCacheEntryExpiredA IsUrlCacheEntryExpiredW LoadUrlCacheContent ParseX509EncodedCertificateForListBoxEntry PrivacyGetZonePreferenceW PrivacySetZonePreferenceW ReadUrlCacheEntryStream RegisterUrlCacheNotification ResumeSuspendedDownload RetrieveUrlCacheEntryFileA RetrieveUrlCacheEntryFileW RetrieveUrlCacheEntryStreamA RetrieveUrlCacheEntryStreamW RunOnceUrlCache SetUrlCacheConfigInfoA SetUrlCacheConfigInfoW SetUrlCacheEntryGroup SetUrlCacheEntryGroupA SetUrlCacheEntryGroupW SetUrlCacheEntryInfoA SetUrlCacheEntryInfoW SetUrlCacheGroupAttributeA SetUrlCacheGroupAttributeW SetUrlCacheHeaderData ShowCertificate ShowClientAuthCerts ShowSecurityInfo ShowX509EncodedCertificate UnlockUrlCacheEntryFile UnlockUrlCacheEntryFileA UnlockUrlCacheEntryFileW UnlockUrlCacheEntryStream UpdateUrlCacheContentPath UrlZonesDetach

Name

.text

Size

280KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

132KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

663b1ee0a0a85b6aed7cab7426f50114c0889d9a07068661db3c37bc3f2891fe

advapi32

kernel32

mpr

ntdll

shell32

shlwapi

ucrtbase

user32

ws2_32

generic