0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3

Sharing

Copy URL Twitter E-mail

General

Target
0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3
Size 955KB
Sample260729-e5mlbawxdt
SHA256 0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3
MD5 d639fc6fc4a8f9606154645eb94aff9e
SHA1 035654253dfdf68b1fe9a3487994c3b01b7f627e
SHA512 6bd7702f6749e7a24c959d9adff6ab47197108d67294e41bb35a6b6a11ef4e9f81f249632a7a56ff8cd8a056792b9ccc4d05fc44a3bd0322c765b9532e468972
SSDEEP 6144:PUhzcbSFx90qiPVbg+rdsRpBRMKQgvPXDo907cbwZzgM93fvYPQNYiPvpAyx:PUhzcbUo9dVjgvfMqxkGPnpAyx
TLSH
T17A25F94163FD8659F6F36B356DB942710A7ABEA2AA39C70F1204901D0D72FD09DA4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3

File Explorer

0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3

.dll 955KB

0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3

IMPHASH e0ed32aa018d7a021a5777b602d95bde
SHA256 0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3
MD5 d639fc6fc4a8f9606154645eb94aff9e
SHA1 035654253dfdf68b1fe9a3487994c3b01b7f627e
SHA512 6bd7702f6749e7a24c959d9adff6ab47197108d67294e41bb35a6b6a11ef4e9f81f249632a7a56ff8cd8a056792b9ccc4d05fc44a3bd0322c765b9532e468972
SSDEEP 6144:PUhzcbSFx90qiPVbg+rdsRpBRMKQgvPXDo907cbwZzgM93fvYPQNYiPvpAyx:PUhzcbUo9dVjgvfMqxkGPnpAyx
TLSH
T17A25F94163FD8659F6F36B356DB942710A7ABEA2AA39C70F1204901D0D72FD09DA4B33
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW

kernel32

CloseHandle CreateEventW CreateFileA CreateThread DelayLoadFailureHook DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FindResourceW FreeLibrary FreeLibraryAndExitThread FreeResource GetDriveTypeW GetFileAttributesA GetFullPathNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProfileStringW GetTickCount HeapAlloc HeapReAlloc InitOnceExecuteOnce InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource LockResource MoveFileA MulDiv MultiByteToWideChar PulseEvent RaiseException ResetEvent ResolveDelayLoadedAPI RtlUnwind SearchPathA SearchPathW SetEvent SetThreadPriority Sleep SleepConditionVariableCS WaitForMultipleObjects WaitForSingleObject WakeConditionVariable WideCharToMultiByte _hwrite _lclose _llseek _lread timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime

msacm32

acmStreamClose acmStreamConvert acmStreamOpen acmStreamPrepareHeader acmStreamSize acmStreamUnprepareHeader

ntdll

RtlCreateUnicodeStringFromAsciiz RtlFreeUnicodeString RtlUpperChar _vsnprintf

ole32

CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _errno _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv malloc memcmp memcpy memmove memset realloc strchr strcmp strcpy strcspn strerror strlen strrchr wcschr wcscmp wcscpy wcsrchr wcsstr wcstoul

user32

CharLowerW CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageA GetActiveWindow GetAsyncKeyState GetMessageA IsWindow KillTimer LoadStringA LoadStringW MessageBoxA MsgWaitForMultipleObjects PeekMessageA PeekMessageW PostMessageA PostMessageW PostThreadMessageA PostThreadMessageW SendMessageA SendMessageW SetTimer SetWindowLongPtrW

CloseDriver DefDriverProc DriverCallback DrvClose DrvDefDriverProc DrvGetModuleHandle DrvOpen DrvOpenA DrvSendMessage GetDriverFlags GetDriverModuleHandle OpenDriver OpenDriverA PlaySound PlaySoundA PlaySoundW SendDriverMessage auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProc16 mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion sndPlaySoundA sndPlaySoundW timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite

Name

.text

Size

144KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

504KB

Virtual Size

502KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0c4d85a520adbd832b067c9264421d379f0d7365b8293e2a661102f3671f12d3

advapi32

kernel32

msacm32

ntdll

ole32

ucrtbase

user32

generic