72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f

Sharing

Copy URL Twitter E-mail

General

Target
72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f
Size 10.7MB
Sample260729-e4xpwsgn4z
SHA256 72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f
MD5 249085eb402266f590260b92ff7c69a7
SHA1 6d9f8d601b9d3d13a7f47aa2a87fdcbf1eb89f75
SHA512 082e0aeaaa0cfc590c8ac3b536de1ec8b451b1bfcc1ec778d3563303ffdb1ca28d162bd73965357ddae93136d0912ed874c447b9014dfe98a94a930d4cf326f9
SSDEEP 196608:1Bu0Misuu80OX//3UX0sAeJInJGmQ7ZqB3rCud92fJ7hiIbfU2c/DycEMw:1I0MiI8PJdeJsGmT5dIB7hiIbsp7KMw
TLSH
T15FB60103BB01D025E1914039242B6FF691B96D359B61C8E3BBE16FB965312E27633F27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f

File Explorer

72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f

.exe 10.7MB

72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f

IMPHASH e446796a21005bcfcef00134bc0291d1
SHA256 72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f
MD5 249085eb402266f590260b92ff7c69a7
SHA1 6d9f8d601b9d3d13a7f47aa2a87fdcbf1eb89f75
SHA512 082e0aeaaa0cfc590c8ac3b536de1ec8b451b1bfcc1ec778d3563303ffdb1ca28d162bd73965357ddae93136d0912ed874c447b9014dfe98a94a930d4cf326f9
SSDEEP 196608:1Bu0Misuu80OX//3UX0sAeJInJGmQ7ZqB3rCud92fJ7hiIbfU2c/DycEMw:1I0MiI8PJdeJsGmT5dIB7hiIbsp7KMw
TLSH
T15FB60103BB01D025E1914039242B6FF691B96D359B61C8E3BBE16FB965312E27633F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6004469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree lstrlenW GetModuleHandleExW VirtualAlloc GetModuleFileNameW CreateFileW UnmapViewOfFile GetModuleHandleA GetLogicalDriveStringsW GetNativeSystemInfo LoadLibraryW CreateProcessW GetModuleHandleW CreateFileMappingW MapViewOfFile GetProcessTimes EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection CreateMutexW ReleaseMutex DeleteCriticalSection OpenMutexW WideCharToMultiByte ReadFile VirtualProtect HeapFree SetLastError ExitThread HeapAlloc GetProcessHeap FreeLibrary GetProcAddress LoadLibraryA FileTimeToSystemTime CreateFileA GetModuleFileNameA SetUnhandledExceptionFilter CloseHandle SetEvent GetLastError CreateEventW OpenEventW GetCurrentProcess GetTickCount GetCurrentProcessId GetCurrentThreadId MultiByteToWideChar WaitForSingleObject TryEnterCriticalSection OutputDebugStringA SetConsoleMode ConvertFiberToThread DeleteFiber GetEnvironmentVariableW SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExA SetConsoleCtrlHandler SetStdHandle GetFullPathNameW GetCurrentDirectoryW ReadConsoleW CreateDirectoryW GetFileAttributesExW GetConsoleCP FindFirstFileW FindNextFileW DeviceIoControl InitializeProcThreadAttributeList CreatePipe FindClose LocalAlloc Sleep GetTimeZoneInformation UpdateProcThreadAttribute GetDiskFreeSpaceExW LocalFree GetComputerNameW lstrcpyW GetDriveTypeW GetComputerNameA GetFileAttributesExA GetVersionExW FileTimeToLocalFileTime SizeofResource InterlockedDecrement HeapSize LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW DecodePointer HeapDestroy GlobalAlloc GlobalFree GetEnvironmentVariableA SearchPathA FindFirstFileA FindNextFileA GetFileAttributesW GetFileAttributesA RemoveDirectoryA CreateDirectoryA SetHandleInformation GetStdHandle WriteFile TerminateProcess PeekNamedPipe GetTempPathW DeleteFileW GetTempFileNameW GetExitCodeProcess GetSystemTimes GetTickCount64 QueryPerformanceFrequency SetFilePointerEx QueryPerformanceCounter ResetEvent ReadConsoleA GetConsoleMode EncodePointer FormatMessageW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitProcess GetFileType SystemTimeToTzSpecificLocalTime GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

MessageBoxW wsprintfW GetUserObjectInformationW GetProcessWindowStation GetKeyState EnumDisplayDevicesA EnumDisplayDevicesW GetSystemMetrics GetDC GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDevicePropertyW

iphlpapi

GetAdaptersAddresses

ws2_32

inet_ntoa gethostname socket htonl WSASetLastError send recv recvfrom htons sendto setsockopt ntohl closesocket WSAStartup WSAGetLastError WSACleanup

pdh

PdhGetFormattedCounterValue PdhOpenQueryW PdhCloseQuery PdhCollectQueryData PdhAddCounterW

wlanapi

WlanGetAvailableNetworkList WlanOpenHandle WlanEnumInterfaces WlanFreeMemory WlanCloseHandle

wevtapi

EvtClose EvtNextChannelPath EvtOpenChannelEnum

advapi32

CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegCloseKey RegSetValueExA RegCreateKeyExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptGenRandom CryptGetHashParam

oleaut32

VarUdateFromDate SysFreeString SysAllocString SysStringLen VariantClear

wtsapi32

WTSSendMessageW

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

621KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dydat0

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.dydat1

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

72bd36764fc9dddebc48879b4af8991a0f9da73c3e8789c984a5743b61c3eb5f

kernel32

user32

setupapi

iphlpapi

ws2_32

pdh

wlanapi

wevtapi

advapi32

oleaut32

wtsapi32

generic