dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350

Sharing

Copy URL Twitter E-mail

General

Target
dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350
Size 1.1MB
Sample260729-e5sgkawxdx
SHA256 dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350
MD5 16eb436bf914367c29aa1a39ffed589d
SHA1 33407d6eea77b309f6a27f622db5df64aaa8706e
SHA512 6850192ca239d1cb46851ca5f37babd7d0840e4d6bd0035b65a969ad74b0a3740a0d4f8e2897091ea35734dc35a3607c5853949a9b39bc036c1a0ff80177445e
SSDEEP 12288:VdZzMl360YQPtU+xvF+tQF/O2SIfXfQ2ZV9:nZzLQVbxvFk+nQ2ZV9
TLSH
T13545936123E48546F2F3973858B692203E367D525B31CB7F924066ED0B33BC29EA5727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350

File Explorer

dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350

.exe 1.1MB

dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350

IMPHASH c1f5586ca13768ec9a7ceb03fe0da3f2
SHA256 dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350
MD5 16eb436bf914367c29aa1a39ffed589d
SHA1 33407d6eea77b309f6a27f622db5df64aaa8706e
SHA512 6850192ca239d1cb46851ca5f37babd7d0840e4d6bd0035b65a969ad74b0a3740a0d4f8e2897091ea35734dc35a3607c5853949a9b39bc036c1a0ff80177445e
SSDEEP 12288:VdZzMl360YQPtU+xvF+tQF/O2SIfXfQ2ZV9:nZzLQVbxvFk+nQ2ZV9
TLSH
T13545936123E48546F2F3973858B692203E367D525B31CB7F924066ED0B33BC29EA5727
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyExW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControls ord320 ord323 ord324 ord388 PropertySheetW

comdlg32

ChooseColorW ChooseFontW GetOpenFileNameW

gdi32

CreateFontIndirectW CreateFontW CreateSolidBrush DeleteObject GetDeviceCaps GetObjectW SetBkColor SetTextColor

kernel32

CloseHandle CreateFileW CreateProcessW DeviceIoControl ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageA GetCommandLineW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetStartupInfoW GetTickCount GetVolumeInformationW GlobalGetAtomNameW HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsWow64Process MulDiv MultiByteToWideChar SetVolumeLabelW WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpiW

ntdll

RtlDosPathNameToNtPathName_U RtlFreeUnicodeString _vsnprintf

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

shell32

ord155 ord195 SHBindToParent SHBrowseForFolderW SHCreateDirectoryExW SHFileOperationW SHGetDesktopFolder SHGetFolderLocation SHGetFolderPathW ShellExecuteW

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveExtensionW StrDupW StrRetToBufW StrRetToStrW

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _assert _configure_wide_argv _get_initial_wide_environment _initialize_wide_environment _set_app_type _strdup _wcsdup _wcsicmp _wcsnicmp bsearch exit free fwrite getenv malloc memcmp memcpy memmove realloc setlocale strchr strcmp strcpy strcspn strlen strrchr toupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstol wcstoul

user32

AdjustWindowRectEx CheckDlgButton CheckRadioButton DestroyIcon DialogBoxParamW DrawEdge DrawFocusRect DrawFrameControl DrawIconEx EnableWindow EndDialog EnumWindows FillRect FrameRect GetClientRect GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemInt GetDpiForWindow GetMenu GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowTextLengthW GetWindowTextW InvalidateRect IsDlgButtonChecked KillTimer LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxIndirectW MessageBoxW MoveWindow ReleaseDC SendDlgItemMessageW SendMessageW SetCursor SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetFocus SetSysColors SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow SystemParametersInfoW

uxtheme

ord2 ord3 ord4 ord8 ord9 ord10 CloseThemeData DrawThemeBackground DrawThemeParentBackground GetCurrentThemeName GetThemeMargins IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeDataForDpi

winmm

PlaySoundW midiOutGetDevCapsW midiOutGetNumDevs

Name

.text

Size

72KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

84KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

648KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

356B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dfa5163ac5f35406ff691c6137f6c14311fda31708f6f87a3bb45c6ab59b9350

advapi32

comctl32

comdlg32

gdi32

kernel32

ntdll

ole32

shell32

shlwapi

ucrtbase

user32

uxtheme

winmm

generic