1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4

Sharing

Copy URL Twitter E-mail

General

Target
1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4
Size 331KB
Sample260729-e9d5qsvakd
SHA256 1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4
MD5 effe522dee3eab5a372f70a1ef11ad32
SHA1 90e3d4e81fd83c4810bca3791ed737252000feaf
SHA512 dc4ca94bacdd85886f2b3e54f4256c0d245c8debae5aa68f3ac32b7a6ce337630ef7cf9291a69593c9993d789d61762f1ef10876e9742c9b7424c6c5cf6c2a11
SSDEEP 3072:5HfDjePWj6rv5/X0scTz+pzD2iDjENuS49GTLBuEoGSBxc7PLEqnk5dHYElTSKLT:5Guj60wYu4TLBtKBxmq6Ngv8M
TLSH
T17F74B4A123E49545F5B29B3C8AFA53312B39FD829A71C70F9600B55F0C32BC09EA5767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4

File Explorer

1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4

.dll 331KB

1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4

IMPHASH 9a2e2fe213a908a21d6916462c9b3ce2
SHA256 1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4
MD5 effe522dee3eab5a372f70a1ef11ad32
SHA1 90e3d4e81fd83c4810bca3791ed737252000feaf
SHA512 dc4ca94bacdd85886f2b3e54f4256c0d245c8debae5aa68f3ac32b7a6ce337630ef7cf9291a69593c9993d789d61762f1ef10876e9742c9b7424c6c5cf6c2a11
SSDEEP 3072:5HfDjePWj6rv5/X0scTz+pzD2iDjENuS49GTLBuEoGSBxc7PLEqnk5dHYElTSKLT:5Guj60wYu4TLBtKBxmq6Ngv8M
TLSH
T17F74B4A123E49545F5B29B3C8AFA53312B39FD829A71C70F9600B55F0C32BC09EA5767
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegGetValueW RegQueryInfoKeyW RegSetValueExW

combase

RoGetActivationFactory RoInitialize RoUninitialize WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer

comctl32

InitCommonControlsEx PropertySheetW

dinput8

DirectInput8Create

gdi32

CreateFontIndirectW DeleteObject Ellipse GetStockObject LineTo MoveToEx Polygon Rectangle RoundRect SelectObject SetBkMode SetDCBrushColor SetDCPenColor SetTextColor

kernel32

ActivateActCtx CloseHandle CreateActCtxW CreateEventW CreateThread DeactivateActCtx DisableThreadLibraryCalls EnterCriticalSection GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapReAlloc LeaveCriticalSection MulDiv ReleaseActCtx SetEvent WaitForMultipleObjects WaitForSingleObject

ntdll

_vsnprintf

ole32

OleInitialize OleUninitialize

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup calloc free fwrite getenv memcmp memmove memset round strchr strcmp strcspn strlen wcscmp wcslen wcsrchr wcsstr

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EnableWindow EndPaint FillRect FindWindowExW GetAncestor GetClientRect GetDlgItem GetSysColor GetWindowLongPtrW GetWindowLongW InvalidateRect MsgWaitForMultipleObjects PeekMessageW RegisterClassW RegisterDeviceNotificationW SendDlgItemMessageW SendMessageW SetWindowLongW ShowWindow TranslateMessage UnregisterClassW UnregisterDeviceNotification

xinput1_3

XInputSetState XInputGetCapabilities XInputGetStateEx

Name

.text

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

140KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1294c1e18989faf428daa98d4c5cf90270e562050c3b07b1814217a630c5c4d4

advapi32

combase

comctl32

dinput8

gdi32

kernel32

ntdll

ole32

ucrtbase

user32

xinput1_3

generic