f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397

Sharing

Copy URL Twitter E-mail

General

Target
f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397
Size 734KB
Sample260729-e4bgnagn3w
SHA256 f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397
MD5 5f7a63e10d1cf38e21edeccba504adc3
SHA1 21bcd9138a9a4b5f8d9bc5048ed08a7b6645c9aa
SHA512 396dc61206afffa9f566857cea2b8c59b481ba85b5056d528be6d8ab7ef0bfcf0aa13edcc11111434e067d123e03f38161898c526970d685d5221359e30a902e
SSDEEP 6144:ny2q1PcICTmFqNg1lAkdAHITuRKJDCDWB9eOyb/ApLQqy2q1PcICTe:nHW4Kag0k2HIHJmD09eOyEZHW4C
TLSH
T1B5F43A40F2D568A3F91B833448E7E23627387A61A357DF17D6049D2C1E777E32D92A0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397

File Explorer

f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397

.dll 734KB

f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397

IMPHASH 9f3335b0210246a56fa598ac15cfd0de
SHA256 f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397
MD5 5f7a63e10d1cf38e21edeccba504adc3
SHA1 21bcd9138a9a4b5f8d9bc5048ed08a7b6645c9aa
SHA512 396dc61206afffa9f566857cea2b8c59b481ba85b5056d528be6d8ab7ef0bfcf0aa13edcc11111434e067d123e03f38161898c526970d685d5221359e30a902e
SSDEEP 6144:ny2q1PcICTmFqNg1lAkdAHITuRKJDCDWB9eOyb/ApLQqy2q1PcICTe:nHW4Kag0k2HIHJmD09eOyEZHW4C
TLSH
T1B5F43A40F2D568A3F91B833448E7E23627387A61A357DF17D6049D2C1E777E32D92A0A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx

gdi32

CreateFontIndirectW GetObjectW GetStockObject LineTo MoveToEx SelectObject SetDCPenColor

kernel32

DisableThreadLibraryCalls EnumResourceNamesW ExpandEnvironmentStringsW FindResourceW GetEnvironmentVariableW GetFileAttributesW GetFullPathNameW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte lstrcmpW lstrcmpiW

ntdll

_vsnprintf

ole32

CoCreateInstance OleCreate OleInitialize OleSetContainedObject OleUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

PathCombineW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _strdup _stricmp _strnicmp _wcsdup _wcsnicmp atoi calloc free fwrite getenv isspace malloc memchr memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen strncmp strstr strtol tolower wcschr wcslen wcsncmp wcsrchr wcsstr

user32

BeginPaint ClientToScreen CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EndPaint FrameRect GetClientRect GetDesktopWindow GetMessageW GetParent GetSubMenu GetSysColor GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextA LoadBitmapW LoadCursorW LoadIconW LoadMenuW LoadStringW MoveWindow PostQuitMessage RegisterClassExW ReleaseCapture SendMessageW SetCapture SetMenuItemInfoW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

68KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

64KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

138B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f7b800deeb202f7e239bf9d9fa6b77066e8d2c978eb127a33f507e864a830397

comctl32

gdi32

kernel32

ntdll

ole32

oleaut32

shlwapi

ucrtbase

user32

generic