259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c

Sharing

Copy URL Twitter E-mail

General

Target
259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c
Size 5.7MB
Sample260729-js2a6afa84
SHA256 259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c
MD5 9d633e51c9b479a22df9c5d18aab07c9
SHA1 6cf2a95d1b349effce3360092c716b7877384483
SHA512 09a5412a4240667550d2b95ed4b90d78731d4b0b11c28eddfba89d14ca691b9792f6f4df6a0913d85e598df5c5e599ebfb5af729df1dde18187216b0a53fbf96
SSDEEP 98304:z2H6HjZjWkyCfm9nw7AcsZTpPRG9qV9gKlzGZniA0wG:z2HmjWxC+9pvZlp+qQUzGZniB
TLSH
T1F256E1A9629433A8D01A84389433FD46F2F6741E1BB586DB36D7E6C03F7B850DA16B07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c

File Explorer

259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c

.exe 5.7MB

259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c

IMPHASH 73543e27fe979d3bf1f8597ad0afc0d9
SHA256 259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c
MD5 9d633e51c9b479a22df9c5d18aab07c9
SHA1 6cf2a95d1b349effce3360092c716b7877384483
SHA512 09a5412a4240667550d2b95ed4b90d78731d4b0b11c28eddfba89d14ca691b9792f6f4df6a0913d85e598df5c5e599ebfb5af729df1dde18187216b0a53fbf96
SSDEEP 98304:z2H6HjZjWkyCfm9nw7AcsZTpPRG9qV9gKlzGZniA0wG:z2HmjWxC+9pvZlp+qQUzGZniB
TLSH
T1F256E1A9629433A8D01A84389433FD46F2F6741E1BB586DB36D7E6C03F7B850DA16B07
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4349230

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32NextW lstrcatW Process32FirstW CloseHandle GetProcAddress CreateProcessW GetModuleHandleW WideCharToMultiByte lstrcmpW GetDriveTypeW GetExitCodeProcess GetPrivateProfileIntW GetPrivateProfileSectionW GetPrivateProfileSectionNamesW GetPrivateProfileStringW GetVersionExW SetLastError GetCurrentThreadId GlobalAlloc GlobalFree GlobalLock GetFileSize GlobalUnlock WritePrivateProfileStringW GetEnvironmentVariableW SetFileAttributesW CreateEventW Sleep MoveFileExW CopyFileW lstrlenW SetFilePointer GetLocalTime GetCurrentProcess DuplicateHandle GetCurrentDirectoryW SystemTimeToFileTime GetFileType DosDateTimeToFileTime WriteConsoleW FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation GetConsoleMode GetConsoleCP SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale MultiByteToWideChar GetCommandLineW GetCommandLineA GetStdHandle ExitProcess DeleteFileW RemoveDirectoryW SetEnvironmentVariableW GetFullPathNameW GetModuleHandleExW ExitThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime CreateToolhelp32Snapshot GetLogicalDriveStringsW CreateFileW WaitForSingleObject FindClose GetModuleFileNameW WriteFile FindNextFileW GetFileSizeEx FindFirstFileW ReadFile CreateDirectoryW DeleteTimerQueueTimer GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection HeapFree PeekNamedPipe VirtualQuery GetSystemInfo RtlPcToFileHeader RtlUnwindEx LoadLibraryW UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread FreeLibrary GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber ChangeTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority CreateThread SignalObjectAndWait CreateTimerQueue GetCurrentProcessId RtlUnwind GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext ResetEvent SetEvent LoadLibraryExA VirtualFree CreateTimerQueueTimer VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead OutputDebugStringW IsDebuggerPresent LocalFree GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW QueryPerformanceCounter EncodePointer GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount FindFirstFileExW GetFileAttributesExW GetFileInformationByHandle SetFilePointerEx FormatMessageW TryEnterCriticalSection WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep LoadLibraryA ExitProcess GetModuleHandleA GetProcAddress

user32

MoveWindow MapWindowPoints GetWindowLongW GetWindow GetWindowRect GetDC SetWindowPos MonitorFromWindow PtInRect DrawTextW GetClientRect UnregisterClassW EqualRect PostMessageW GetActiveWindow MessageBoxW EndPaint BeginPaint ReleaseDC IsIconic InvalidateRect DialogBoxParamW IntersectRect SetWindowLongPtrW SetWindowRgn EndDialog SetWindowTextW ShowWindow GetMonitorInfoW GetParent CopyRect

gdi32

CreateCompatibleBitmap GetObjectW BitBlt DeleteObject CreateRoundRectRgn SelectObject CreateDIBSection GetDIBColorTable SetDIBColorTable CreateCompatibleDC StretchBlt CreateFontW DeleteDC SetTextColor SetBkMode

advapi32

CloseServiceHandle OpenServiceW RegQueryInfoKeyW RegEnumKeyExW RegCloseKey RegQueryValueExW OpenSCManagerW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW

ole32

CoInitializeEx CreateStreamOnHGlobal CoUninitialize

oleaut32

VariantClear

shlwapi

PathAppendW PathFileExistsW PathAddBackslashW PathFindExtensionW PathRemoveFileSpecW PathIsDirectoryW PathFindFileNameW

gdiplus

GdipFree GdipCreateBitmapFromStream GdiplusStartup GdipDrawImageI GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetImageWidth GdipGetImagePalette GdipDeleteGraphics GdipGetImageGraphicsContext GdipBitmapLockBits GdipAlloc GdipGetImagePixelFormat GdipDisposeImage GdipBitmapUnlockBits GdipCloneImage GdipGetImagePaletteSize GdipGetImageHeight GdiplusShutdown

msimg32

TransparentBlt AlphaBlend

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wininet

InternetSetOptionA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA

Name

.text

Size

521KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

188KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.???0

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.???1

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.???2

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

38KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

259a44c9981ad2f0e0cdad67b66375fca0b25538bc8f38c0590704fba4990e7c

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

msimg32

iphlpapi

version

wininet

generic