6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1

Sharing

Copy URL Twitter E-mail

General

Target
6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1
Size 15.3MB
Sample260730-py9sdaap6w
SHA256 6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1
MD5 1478a7418d3d103e73c098fc714cc1e4
SHA1 b097f33e8e4a9175b33655ddf00e2432c60c88b9
SHA512 310931ab4cf536d4ac442053894eeec3531754befcd8f3970d1e109b66c5b0a5a1ddd270372645c9c912f0f90fd6ee8d6241b1cf29988148ed4918b34f3fbe40
SSDEEP 98304:MvruXDPZYno4/DoU5aL5cfeZo/Y7mgTm05AwJHE6h6dOy00sgNquDJus:McPk/l5aLig7PAmkN0V0l
TLSH
T112F6B6C68126D191C1E4B63431557123EF2BF85D923CA26A9FF28F1976FFF40A46A60C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1

File Explorer

6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1

.exe 15.3MB

6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1

IMPHASH 6f02759e81b22fe25ac352e2c4a7fe55
SHA256 6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1
MD5 1478a7418d3d103e73c098fc714cc1e4
SHA1 b097f33e8e4a9175b33655ddf00e2432c60c88b9
SHA512 310931ab4cf536d4ac442053894eeec3531754befcd8f3970d1e109b66c5b0a5a1ddd270372645c9c912f0f90fd6ee8d6241b1cf29988148ed4918b34f3fbe40
SSDEEP 98304:MvruXDPZYno4/DoU5aL5cfeZo/Y7mgTm05AwJHE6h6dOy00sgNquDJus:McPk/l5aLig7PAmkN0V0l
TLSH
T112F6B6C68126D191C1E4B63431557123EF2BF85D923CA26A9FF28F1976FFF40A46A60C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11209120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetNumberOfConsoleInputEvents ReadConsoleInputW GetModuleFileNameW GlobalLock GlobalUnlock GlobalAlloc GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleA QueryFullProcessImageNameA GetModuleHandleW GetFileAttributesExW WaitForSingleObjectEx SetConsoleCP SetConsoleOutputCP GetCommandLineW VerifyVersionInfoW VerSetConditionMask GetUserDefaultGeoName GetUserDefaultLCID HeapSize SetEndOfFile SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage HeapReAlloc SetFilePointerEx GetConsoleOutputCP EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect ReadConsoleW HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree Process32NextW GetFileType GetCommandLineA IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess GetConsoleCP OpenProcess Process32FirstW Sleep WaitForSingleObject SetWaitableTimerEx CreateWaitableTimerExW GetTickCount MoveFileExW GetTickCount64 Module32NextW FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry ReadFile GetFileSizeEx CreateFileA FormatMessageW SetLastError GetEnvironmentVariableA GetSystemDirectoryA SleepEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer WakeAllConditionVariable Module32FirstW CreateToolhelp32Snapshot WideCharToMultiByte ReadProcessMemory VirtualQueryEx CloseHandle FlushFileBuffers WriteFile GetStdHandle GetLastError CreateFileW GetEnvironmentVariableW SetConsoleTextAttribute SetConsoleMode SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterW WakeConditionVariable InitOnceComplete InitOnceBeginInitialize GetExitCodeThread GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared GetConsoleScreenBufferInfo SetConsoleCursorInfo AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx GetConsoleCursorInfo WriteConsoleW MultiByteToWideChar GetConsoleMode CopyFile2 FormatMessageA LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI RtlUnwind

user32

FindWindowW GetForegroundWindow ShowCursor SetWindowLongW GetWindowLongW SetWindowPos SetCapture keybd_event SetForegroundWindow SetFocus ReleaseCapture IsChild GetWindowThreadProcessId SetCursorPos OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetKeyboardLayout IsIconic LoadCursorW GetKeyState ClientToScreen GetCursorPos ScreenToClient GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture IsWindowUnicode SetProcessDPIAware GetDC ReleaseDC MonitorFromWindow DestroyWindow UnregisterClassA GetMonitorInfoA EnumDisplaySettingsA FindWindowA PeekMessageW TranslateMessage DispatchMessageW mouse_event GetAsyncKeyState GetSystemMetrics SetCursor SetWindowDisplayAffinity DefWindowProcW PostQuitMessage UpdateWindow ShowWindow UnregisterClassW SetLayeredWindowAttributes CreateWindowExW RegisterClassExW

gdi32

GetDeviceCaps CreateDCA DeleteDC

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathW

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError recv bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl inet_pton WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo ioctlsocket

crypt32

CertCreateCertificateChainEngine CryptQueryObject CertGetCertificateChain CertFindExtension CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertFreeCertificateChainEngine CertFreeCertificateChain CertGetNameStringA CertAddCertificateContextToStore

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmFlush DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

dcomp

DCompositionCreateDevice

Name

.text

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

509KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6d5a9a71038ab36d8ac7f24a513612f5d94bee65104d7ad32d1e2e2763f180b1

kernel32

user32

gdi32

advapi32

shell32

ws2_32

crypt32

bcrypt

d3d11

d3dcompiler_47

dwmapi

imm32

dcomp

generic