Unconfirmed 424230[.]crdownload

Sharing

Copy URL Twitter E-mail

General

Target
Unconfirmed 424230.crdownload
Size 9.0MB
Sample260731-1nlhkshc39
SHA256 ad18841f372ca5f16a8d2c067b0d177bca0ffba8dd13a75774e07fd85483bbef
MD5 07fcc0444719e24fb9c2373f7592c9d5
SHA1 6aee6455720c8c87bcd0c4fc8173d291f11f7db5
SHA512 783fdb1f4b45eef9904db0af5a63a83fd8a807edcfe397875398c21263165716a5c9d8dc04f6d60c279252ffa0d2885508dfe5c932d7f575cc0783c2f54bcf3f
SSDEEP 196608:EdS5kN5cytwctrPbrg+M60LRC3TSUQe75LSXWhCx7xpElSI6ooOdSYNq/fu/UkEB:EdLNLN73g+M6QRC3TSUQe75LSXWhCx73
TLSH
T1AA969D5266ED82A9D257F37A8A42D05BEB313F541321C2EF32C19A6B3B136D7467E301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Unconfirmed 424230.crdownload

File Explorer

Unconfirmed 424230.crdownload

.exe 9.0MB

Unconfirmed 424230.crdownload

IMPHASH b05d92629476446a9a7a1596bdc3bc77
SHA256 ad18841f372ca5f16a8d2c067b0d177bca0ffba8dd13a75774e07fd85483bbef
MD5 07fcc0444719e24fb9c2373f7592c9d5
SHA1 6aee6455720c8c87bcd0c4fc8173d291f11f7db5
SHA512 783fdb1f4b45eef9904db0af5a63a83fd8a807edcfe397875398c21263165716a5c9d8dc04f6d60c279252ffa0d2885508dfe5c932d7f575cc0783c2f54bcf3f
SSDEEP 196608:EdS5kN5cytwctrPbrg+M60LRC3TSUQe75LSXWhCx7xpElSI6ooOdSYNq/fu/UkEB:EdLNLN73g+M6QRC3TSUQe75LSXWhCx73
TLSH
T1AA969D5266ED82A9D257F37A8A42D05BEB313F541321C2EF32C19A6B3B136D7467E301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3877388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateProcessW Process32FirstW Process32NextW ReleaseMutex CreateMutexA GetLogicalDrives ExitProcess GetFileAttributesA GetModuleFileNameA CreateProcessA VirtualQuery GetThreadContext GetSystemInfo LoadLibraryA GetCurrentThread CreateFileA VirtualProtect GetCurrentProcessId ReadProcessMemory VirtualAllocEx GetProcAddress GetLastError OpenProcess GetModuleHandleA VirtualAlloc GetCurrentProcess VirtualFree CloseHandle UnmapViewOfFile MapViewOfFile CreateFileMappingW WriteConsoleW HeapSize SetEndOfFile GetProcessHeap SetEnvironmentVariableW GetModuleHandleW UnhandledExceptionFilter AddVectoredExceptionHandler FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreatePipe HeapReAlloc ReadConsoleW GetExitCodeProcess SetStdHandle DeleteFileW FlushFileBuffers GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation GetCurrentThreadId RemoveVectoredExceptionHandler GetComputerNameA GetVolumeInformationA GetSystemFirmwareTable EnumSystemLocalesW GetUserDefaultLCID ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte TryAcquireSRWLockExclusive QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSection GetLocaleInfoA IsDBCSLeadByte FreeLibrary OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock SetLastError FormatMessageW GetSystemDirectoryW LoadLibraryW WaitForSingleObject CreateEventW SetEvent GetTickCount SleepEx VerifyVersionInfoW GetEnvironmentVariableA ReadFile GetStdHandle WaitForMultipleObjects PeekNamedPipe GetFileType GetFileSizeEx RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime DuplicateHandle GetModuleFileNameW WriteFile SetFilePointerEx HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale RtlUnwind

user32

OpenClipboard CloseClipboard ShowWindow GetActiveWindow MessageBoxA EmptyClipboard FlashWindowEx SetForegroundWindow IsIconic DefWindowProcW GetClipboardData SetClipboardData GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture

gdi32

BitBlt

advapi32

RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExA RegOpenKeyExA RegGetValueA GetUserNameA CryptDestroyKey CryptEncrypt SystemFunction036 OpenThreadToken CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptImportKey CryptAcquireContextW

shell32

ShellExecuteA SHGetKnownFolderPath ShellExecuteW

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CreateStreamOnHGlobal CLSIDFromString CoInitializeEx GetHGlobalFromStream

tbs

Tbsi_Context_Create Tbsip_Submit_Command Tbsip_Context_Close

dbghelp

SymGetModuleBase64 SymFunctionTableAccess64

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA VerQueryValueA

ntdll

VerSetConditionMask RtlLookupFunctionEntry RtlInitUnicodeString RtlCaptureContext RtlVirtualUnwind NtQuerySystemInformation

gdiplus

GdiplusShutdown GdiplusStartup GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipSaveImageToStream

winmm

PlaySoundW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

bcrypt

BCryptGenRandom

ws2_32

gethostname ioctlsocket WSAStartup WSACleanup WSAGetLastError WSAEnumNetworkEvents getsockopt WSAWaitForMultipleEvents send WSAResetEvent WSAEventSelect WSACreateEvent WSACloseEvent ntohs WSASetLastError closesocket setsockopt htons recv connect socket getsockname getpeername WSAIoctl bind select __WSAFDIsSet sendto recvfrom listen accept htonl freeaddrinfo getaddrinfo

wldap32

ord142 ord14 ord145 ord208 ord27 ord147 ord216 ord41 ord26 ord79 ord127 ord46 ord117 ord301 ord219 ord133 ord73 ord167

crypt32

CertGetNameStringW CertFindExtension CertCreateCertificateChainEngine CryptQueryObject CertGetCertificateChain CertFreeCertificateChainEngine PFXImportCertStore CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertOpenStore CryptStringToBinaryW CryptDecodeObjectEx CertFindCertificateInStore CertAddCertificateContextToStore

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.cpax

Size

2.9MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Unconfirmed 424230.crdownload

kernel32

user32

gdi32

advapi32

shell32

ole32

tbs

dbghelp

version

ntdll

gdiplus

winmm

imm32

bcrypt

ws2_32

wldap32

crypt32

generic