17_99_GordonSYS_Me[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
17_99_GordonSYS_Me.rar
Size 119KB
Sample260730-has2dsej9x
SHA256 901f00366b5d657b88e4593bcb40e2884b5aae2a6950b5407ad4e858b9b24c56
MD5 1768d11e3f63fd723ec3c5761a543ea0
SHA1 a3f3573a6054865068279c56a993696bc85b977d
SHA512 ad0ea2659c2170be93fd86519995d78f77bcf576373427535d077519c0873bee6bccb5f0eb0489570b4f39200dbc9b3b673c8c79824cb0fc567e33620c0536a1
SSDEEP 3072:9TLWfQSvkPBiS2VE3vN+ZQnRZ6haxsZYpuslGy0nbZ6bX:9n3PMS40N+ZmRrxeYblGrn16X
TLSH
T182C3128447D730E340D995802B715B609020BC697EA394CA568CF1FBAFF5C9FA99CB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GordonSYS Menu 1.2.dll

File Explorer

17_99_GordonSYS_Me.rar

.rar 119KB
GordonSYS Menu 1.2.dll

.dll 265KB

17_99_GordonSYS_Me.rar

SHA256 901f00366b5d657b88e4593bcb40e2884b5aae2a6950b5407ad4e858b9b24c56
MD5 1768d11e3f63fd723ec3c5761a543ea0
SHA1 a3f3573a6054865068279c56a993696bc85b977d
SHA512 ad0ea2659c2170be93fd86519995d78f77bcf576373427535d077519c0873bee6bccb5f0eb0489570b4f39200dbc9b3b673c8c79824cb0fc567e33620c0536a1
SSDEEP 3072:9TLWfQSvkPBiS2VE3vN+ZQnRZ6haxsZYpuslGy0nbZ6bX:9n3PMS40N+ZmRrxeYblGrn16X
TLSH
T182C3128447D730E340D995802B715B609020BC697EA394CA568CF1FBAFF5C9FA99CB16
MD5 SHA1 SHA512 SSDEEP TLSH

GordonSYS Menu 1.2.dll

IMPHASH cc46c651d42c9b1458520f573ade6e88
SHA256 761df8da4997b7985a89ed5109e91b5646a3c85583ddc97da44e11eb8d82c755
MD5 97a4d87c8b4c7ff0ed2bb73c639eb449
SHA1 cee4a372a521bfab63da395a4fc42c372daea369
SHA512 55020fb470e36d43f0bc89f05149cbb1c95b2364e94d46586025ff66dd00e282fb966d4097aef13ca5ae35d52928c0dc72a9c4fc3ec92c47ea055e18a25d1ba2
SSDEEP 6144:T/bI7M7q89byRQkocETAOR9buXJ68FTN:gMmDGkocEThba
TLSH
T192447C9033E3EC3BC0AA12B58986D3720E69BC705364D9D37BD46979DE312C09A35F66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54701

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Basti\Documents\Visual Studio 2008\Projects\Kotentopfs Base\Release\Kotentopfs Base.pdb

kernel32

VirtualProtect GetModuleHandleW Sleep WritePrivateProfileStringW GetPrivateProfileIntW DisableThreadLibraryCalls GlobalMemoryStatusEx FlushInstructionCache SetEnvironmentVariableA CompareStringW CompareStringA GetProcessHeap SetEndOfFile CreateFileA CreateThread GetCurrentProcess GetLocaleInfoW CreateFileW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA InterlockedIncrement InterlockedDecrement InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapAlloc GetLastError HeapFree DeleteFileA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException MultiByteToWideChar LCMapStringA WideCharToMultiByte LCMapStringW GetCPInfo VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA ReadFile GetConsoleCP GetConsoleMode FlushFileBuffers TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetTimeZoneInformation SetFilePointer CloseHandle FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetModuleHandleA

user32

GetAsyncKeyState wsprintfW mouse_event GetSystemMetrics GetCursorPos

gdi32

AddFontMemResourceEx

d3dx9_43

D3DXCreateFontW D3DXCreateLine

wininet

FtpGetFileW InternetConnectA InternetCloseHandle InternetOpenW