961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c

Sharing

Copy URL Twitter E-mail

General

Target
961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c
Size 15.3MB
Sample260730-mpgn5awbpc
SHA256 961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c
MD5 39a82846745d311a64b4843f28e4f875
SHA1 a49dbed016270d99827908bdc00a6b7d1dbf6700
SHA512 db0857206011dec690feead3c0084c93c2346739d358a087021e737f3967e400e6b897650f8f8590f1680da8e22f31de8e59d1993cda404075b9c778b8d4c813
SSDEEP 98304:/vs/oEABrIZIGNKb6wHXxo/Y7mgTm05AwJHE6hx6w24Y2CyuuDJud+t:n7dIZBKbag7PAmke6wVY2C0S
TLSH
T16CF6C7C68136D191C1E8B63431557123EF2BF85D923CA26A9FF18F1976FFF40A46A608
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c

File Explorer

961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c

.exe 15.3MB

961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c

IMPHASH da6a80edc00914cea10d693e46e279a7
SHA256 961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c
MD5 39a82846745d311a64b4843f28e4f875
SHA1 a49dbed016270d99827908bdc00a6b7d1dbf6700
SHA512 db0857206011dec690feead3c0084c93c2346739d358a087021e737f3967e400e6b897650f8f8590f1680da8e22f31de8e59d1993cda404075b9c778b8d4c813
SSDEEP 98304:/vs/oEABrIZIGNKb6wHXxo/Y7mgTm05AwJHE6hx6w24Y2CyuuDJud+t:n7dIZBKbag7PAmke6wVY2C0S
TLSH
T16CF6C7C68136D191C1E8B63431557123EF2BF85D923CA26A9FF18F1976FFF40A46A608
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10980240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GlobalAlloc GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleA QueryFullProcessImageNameA GetModuleHandleW GetFileAttributesExW WaitForSingleObjectEx RtlUnwind GlobalLock GetModuleFileNameW ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleCP HeapSize SetEndOfFile SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage HeapReAlloc GetConsoleOutputCP EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect ReadConsoleW HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW GetCommandLineA IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess GetConsoleCP FlsFree FlsSetValue FlsGetValue SetConsoleOutputCP GetCommandLineW VerifyVersionInfoW VerSetConditionMask GetUserDefaultGeoName GetUserDefaultLCID Process32NextW OpenProcess Process32FirstW WaitForSingleObject SetWaitableTimerEx CreateWaitableTimerExW GetTickCount MoveFileExW Sleep ReadFile GetTickCount64 Module32NextW FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetFileSizeEx CreateFileA WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA MoveFileExA FormatMessageW SetLastError GetSystemDirectoryA SleepEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable InitOnceComplete InitOnceBeginInitialize GetExitCodeThread GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFile2 AreFileApisANSI DeleteFileW CreateFile2 GetTempPathW SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesW FindNextFileW FindFirstFileExW FindFirstFileW Module32FirstW CreateToolhelp32Snapshot WideCharToMultiByte ReadProcessMemory VirtualQueryEx CloseHandle FlushFileBuffers WriteFile GetLastError CreateFileW GetEnvironmentVariableW SetConsoleTextAttribute SetConsoleMode SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterW GetConsoleScreenBufferInfo FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx LocalFree FormatMessageA SetConsoleCursorInfo GetConsoleCursorInfo GlobalUnlock WriteConsoleW MultiByteToWideChar GetConsoleMode GetStdHandle

user32

SetFocus GetAsyncKeyState SetForegroundWindow SetWindowLongW ReleaseCapture keybd_event SetCapture SetWindowPos GetWindowLongW PostQuitMessage UpdateWindow ShowWindow UnregisterClassW ShowCursor GetForegroundWindow FindWindowW mouse_event GetSystemMetrics IsIconic SetLayeredWindowAttributes CreateWindowExW RegisterClassExW IsChild GetWindowThreadProcessId SetCursorPos OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetKeyboardLayout SetCursor LoadCursorW GetKeyState ClientToScreen GetCursorPos ScreenToClient GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture IsWindowUnicode SetProcessDPIAware GetDC ReleaseDC MonitorFromWindow DestroyWindow UnregisterClassA GetMonitorInfoA EnumDisplaySettingsA FindWindowA PeekMessageW TranslateMessage DispatchMessageW SetWindowDisplayAffinity DefWindowProcW

gdi32

DeleteDC CreateDCA GetDeviceCaps

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptGenRandom CryptAcquireContextA RegCreateKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegOpenKeyExA CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext

shell32

SHGetFolderPathW ShellExecuteW ShellExecuteA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantInit VariantClear SysAllocString

normaliz

IdnToAscii

ws2_32

__WSAFDIsSet gethostname ioctlsocket send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError recv bind connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl WSAStartup WSACleanup sendto select accept htonl listen getaddrinfo freeaddrinfo recvfrom

wldap32

ord46 ord45 ord211 ord60 ord50 ord41 ord22 ord217 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord26 ord143

crypt32

CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmFlush DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

dcomp

DCompositionCreateDevice

Name

.text

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

509KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

961c4140453429388b8cd3dc2a948a7dd4f139459cf17b06d190182e9295ba1c

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

normaliz

ws2_32

wldap32

crypt32

rpcrt4

d3d11

d3dcompiler_47

dwmapi

imm32

dcomp

generic