6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce

Sharing

Copy URL Twitter E-mail

General

Target
6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce
Size 5.1MB
Sample260729-e4ybesea62
SHA256 6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce
MD5 1a8576eb4eae2ddd9ea06709cd847246
SHA1 a53dbcf2ec992d2b59529a3644058adcb84a38eb
SHA512 39faad247150eca19fbbaed6cfaa11d9ca6fde54f3b5f754919c728557cdba08e27d56e5471c64b0a991b4dbc6c3a2c307241303a45d7aa8f644bf949b259109
SSDEEP 98304:BjCmxiOiZmjPyOB3Q78CptLKZj9hEj7JICN9h5iT5C5yoFFZ+2cCyDycEMw+:EmQ7ZqB3rCud9yfJ7hiIbfU2c/DycEMw
TLSH
T1E94623335164158AD5FAD83E8827ADA031F6032B8DC3A8B4B5FFD5D62932DC1E727942
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce

File Explorer

6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce

.exe 5.1MB

6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce

IMPHASH e446796a21005bcfcef00134bc0291d1
SHA256 6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce
MD5 1a8576eb4eae2ddd9ea06709cd847246
SHA1 a53dbcf2ec992d2b59529a3644058adcb84a38eb
SHA512 39faad247150eca19fbbaed6cfaa11d9ca6fde54f3b5f754919c728557cdba08e27d56e5471c64b0a991b4dbc6c3a2c307241303a45d7aa8f644bf949b259109
SSDEEP 98304:BjCmxiOiZmjPyOB3Q78CptLKZj9hEj7JICN9h5iT5C5yoFFZ+2cCyDycEMw+:EmQ7ZqB3rCud9yfJ7hiIbfU2c/DycEMw
TLSH
T1E94623335164158AD5FAD83E8827ADA031F6032B8DC3A8B4B5FFD5D62932DC1E727942
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6004469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualFree lstrlenW GetModuleHandleExW VirtualAlloc GetModuleFileNameW CreateFileW UnmapViewOfFile GetModuleHandleA GetLogicalDriveStringsW GetNativeSystemInfo LoadLibraryW CreateProcessW GetModuleHandleW CreateFileMappingW MapViewOfFile GetProcessTimes EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection CreateMutexW ReleaseMutex DeleteCriticalSection OpenMutexW WideCharToMultiByte ReadFile VirtualProtect HeapFree SetLastError ExitThread HeapAlloc GetProcessHeap FreeLibrary GetProcAddress LoadLibraryA FileTimeToSystemTime CreateFileA GetModuleFileNameA SetUnhandledExceptionFilter CloseHandle SetEvent GetLastError CreateEventW OpenEventW GetCurrentProcess GetTickCount GetCurrentProcessId GetCurrentThreadId MultiByteToWideChar WaitForSingleObject TryEnterCriticalSection OutputDebugStringA SetConsoleMode ConvertFiberToThread DeleteFiber GetEnvironmentVariableW SetEndOfFile WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExA SetConsoleCtrlHandler SetStdHandle GetFullPathNameW GetCurrentDirectoryW ReadConsoleW CreateDirectoryW GetFileAttributesExW GetConsoleCP FindFirstFileW FindNextFileW DeviceIoControl InitializeProcThreadAttributeList CreatePipe FindClose LocalAlloc Sleep GetTimeZoneInformation UpdateProcThreadAttribute GetDiskFreeSpaceExW LocalFree GetComputerNameW lstrcpyW GetDriveTypeW GetComputerNameA GetFileAttributesExA GetVersionExW FileTimeToLocalFileTime SizeofResource InterlockedDecrement HeapSize LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW DecodePointer HeapDestroy GlobalAlloc GlobalFree GetEnvironmentVariableA SearchPathA FindFirstFileA FindNextFileA GetFileAttributesW GetFileAttributesA RemoveDirectoryA CreateDirectoryA SetHandleInformation GetStdHandle WriteFile TerminateProcess PeekNamedPipe GetTempPathW DeleteFileW GetTempFileNameW GetExitCodeProcess GetSystemTimes GetTickCount64 QueryPerformanceFrequency SetFilePointerEx QueryPerformanceCounter ResetEvent ReadConsoleA GetConsoleMode EncodePointer FormatMessageW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW UnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread LoadLibraryExW ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitProcess GetFileType SystemTimeToTzSpecificLocalTime GetCommandLineA GetCommandLineW GetACP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

MessageBoxW wsprintfW GetUserObjectInformationW GetProcessWindowStation GetKeyState EnumDisplayDevicesA EnumDisplayDevicesW GetSystemMetrics GetDC GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiGetDevicePropertyW

iphlpapi

GetAdaptersAddresses

ws2_32

inet_ntoa gethostname socket htonl WSASetLastError send recv recvfrom htons sendto setsockopt ntohl closesocket WSAStartup WSAGetLastError WSACleanup

pdh

PdhGetFormattedCounterValue PdhOpenQueryW PdhCloseQuery PdhCollectQueryData PdhAddCounterW

wlanapi

WlanGetAvailableNetworkList WlanOpenHandle WlanEnumInterfaces WlanFreeMemory WlanCloseHandle

wevtapi

EvtClose EvtNextChannelPath EvtOpenChannelEnum

advapi32

CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryInfoKeyA RegQueryValueExA RegCloseKey RegSetValueExA RegCreateKeyExA DeregisterEventSource RegisterEventSourceW ReportEventW CryptGenRandom CryptGetHashParam

oleaut32

VarUdateFromDate SysFreeString SysAllocString SysStringLen VariantClear

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dydat0

Size

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.dydat1

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

869B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6c0cd189042d6505c401ca9be163a7d54b1266947ed9c95d8baebbb016492fce

kernel32

user32

setupapi

iphlpapi

ws2_32

pdh

wlanapi

wevtapi

advapi32

oleaut32

wtsapi32

generic