905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a

Sharing

Copy URL Twitter E-mail

General

Target
905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a
Size 2.9MB
Sample260730-ll38aaverb
SHA256 905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a
MD5 70c8c54c9de8fcaa533d9d4ae463774c
SHA1 86ba2b0cc8d912c28188c8cd3f37133f13b97021
SHA512 2f9ac6b0395951705a64e56b50e0ecaae8261365d8b115031479ff199933994fb5ff54d9cbc50ca73f7c4946afaf2de5894beff8fc7476454e443414350403ea
SSDEEP 49152:Br8TNiOWW7k5c0wJrOmml8Z2qU+s8atKUZUPFyWH330hHzshJ1lBnAZiqC1ID2JH:BrXOWW7pOms8Z2qPPFP330hHzshtmZi9
TLSH
T10EE58D1179028172DA6B0132ADAEBB6F495DA6B20B7894C3B3C45E1F3DB46D31F31297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a

File Explorer

905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a

.exe 2.9MB

905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a

IMPHASH 316337cb4b2a5b4f167c29054f9256ea
SHA256 905e60ad971626a0c3cf35f607e99d09a6cee3274e4c14ce341c979d4836293a
MD5 70c8c54c9de8fcaa533d9d4ae463774c
SHA1 86ba2b0cc8d912c28188c8cd3f37133f13b97021
SHA512 2f9ac6b0395951705a64e56b50e0ecaae8261365d8b115031479ff199933994fb5ff54d9cbc50ca73f7c4946afaf2de5894beff8fc7476454e443414350403ea
SSDEEP 49152:Br8TNiOWW7k5c0wJrOmml8Z2qU+s8atKUZUPFyWH330hHzshJ1lBnAZiqC1ID2JH:BrXOWW7pOms8Z2qPPFP330hHzshtmZi9
TLSH
T10EE58D1179028172DA6B0132ADAEBB6F495DA6B20B7894C3B3C45E1F3DB46D31F31297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1718153

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

soundlib

CreateSoundLib

winmm

waveOutPrepareHeader timeGetTime waveOutGetNumDevs waveOutGetDevCapsA waveOutSetVolume waveOutOpen waveOutClose waveOutUnprepareHeader waveOutWrite waveOutReset waveInGetNumDevs waveInGetDevCapsA waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset

ss3dgfunc

_WriteTGA@24 _Normalize@8 _COLORtoDWORD@16 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16 _SetInverseMatrix@8 _VECTOR3Length@4 _SetRotationYMatrix@8 _CrossProduct@12

wsock32

socket send recv ioctlsocket htons inet_addr closesocket WSACleanup WSAStartup gethostbyname connect

dinput8

DirectInput8Create

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc InitializeSListHead GetThreadTimes OutputDebugStringW GetTimeZoneInformation SetStdHandle GetFileSize CloseHandle GetLocalTime OpenFile IsDBCSLeadByte ReleaseMutex WaitForSingleObject CreateMutexA CreateDirectoryA GetTickCount DeleteFileA MultiByteToWideChar WideCharToMultiByte LCMapStringA Sleep GlobalAlloc GlobalLock GlobalUnlock lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA CreateToolhelp32Snapshot Process32First Process32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary GetProcAddress LoadLibraryA QueryPerformanceCounter QueryPerformanceFrequency ReadFile CreateFileA GetLastError lstrcmpiA InterlockedCompareExchange GetModuleHandleA lstrcpynA WriteFile OpenProcess GetCurrentProcess GetCurrentProcessId TerminateProcess CreateThread GetModuleFileNameA GetFileAttributesA InterlockedExchange SetUnhandledExceptionFilter WriteConsoleW GetCurrentThreadId InitializeCriticalSection HeapAlloc LeaveCriticalSection DeleteCriticalSection FindClose lstrcatA GetLogicalDriveStringsA GetTempPathA RemoveDirectoryA QueryDosDeviceA SetFileAttributesA FindFirstFileA FindNextFileA CopyFileA GetVersionExA InterlockedExchangeAdd GetPrivateProfileIntA GetPrivateProfileStringA GetSystemTimeAsFileTime GetSystemTime GetModuleFileNameW GetProcessHeap FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType GetStdHandle HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetEvent GetModuleHandleW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError UnhandledExceptionFilter GetCPInfo HeapFree FileTimeToSystemTime SystemTimeToTzSpecificLocalTime IsProcessorFeaturePresent IsDebuggerPresent RaiseException RtlUnwind GetStringTypeW FlushFileBuffers GetFileAttributesExW EnterCriticalSection CreateDirectoryW CreateFileW SetEndOfFile SetEnvironmentVariableA LocalFree DecodePointer EncodePointer GetCurrentThread GetCommandLineA LoadLibraryExW ExitThread AreFileApisANSI GetModuleHandleExW ExitProcess WritePrivateProfileStringA

user32

TranslateMessage wsprintfA SetRect MessageBoxA CharNextA CharPrevA GetAsyncKeyState OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CopyRect PostMessageA OffsetRect GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient GetDC LoadCursorFromFileA SetCursor LoadCursorA FillRect SetForegroundWindow DrawTextA RegisterClassA LoadIconA SetWindowLongA GetWindowLongA ShowCursor EndPaint BeginPaint UpdateWindow EndMenu GetSystemMenu GetSystemMetrics KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExW CreateWindowExA RegisterClassExW RegisterClassExA PostQuitMessage DefWindowProcA UnregisterHotKey PeekMessageA DispatchMessageA GetClientRect ReleaseDC

gdi32

SetTextColor SetBkMode CreateSolidBrush CreateFontA GetStockObject RemoveFontResourceExA AddFontResourceExA SelectObject GetTextExtentPoint32A DeleteObject CreateFontIndirectA TextOutA

advapi32

RegQueryValueExA RegOpenKeyExA RegQueryInfoKeyA RegCloseKey

shell32

ShellExecuteA

ole32

CoInitialize CoCreateInstance CoFreeUnusedLibraries CoUninitialize

oleaut32

VariantClear

freeimage

_FreeImage_Unload@4 _FreeImage_GetBits@4 _FreeImage_Load@12 _FreeImage_GetInfo@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_SaveJPEG@12

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW EnumProcessModules GetProcessImageFileNameA

gdiplus

GdipDrawImageRectI GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromFile GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc

generic

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=225, version=20806,

count=3, id=199, version=41118,

count=50, id=223, productName=VS2013 build 21005, version=21005,

count=137, id=225, productName=VS2013 build 21005, version=21005,

count=244, id=224, productName=VS2013 build 21005, version=21005,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD4 build 31101, version=31101,

count=24, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=341, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=662, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,