6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb

Sharing

Copy URL Twitter E-mail

General

Target
6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb
Size 2.6MB
Sample260731-mm3htagg33
SHA256 6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb
MD5 f8fd38518eba0dc909bb05b7fa7f4cb0
SHA1 fb1dc2b8470464040dcb9a802f7d0e2b3eac1a07
SHA512 2a0b7f0cec30682bdbadc3b85ee6549b9bc41f0dc3ce96aff89c9a16dc2f1202652b5807a0443271652f97efdbf6bfd8f40b1752e86cbac9caf8ece55decd1e1
SSDEEP 49152:ppDCH6YdVM2aHA8i0o4BjTYqjzHPqcYO5KQkTq6MV/:poH6YDMtK4FzicYtQV
TLSH
T152D5AE0EFB828C71E59E023A51AA977B4E3AAD205324CDC797B138699D301D2763F395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb

File Explorer

6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb

.exe 2.6MB

6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb

IMPHASH c59db61f5688763c0d0977dbcfe35b63
SHA256 6cbfe53fa700577ceae5a96e7fd1402f73a6994f23d1f4336a2a8d1c823962bb
MD5 f8fd38518eba0dc909bb05b7fa7f4cb0
SHA1 fb1dc2b8470464040dcb9a802f7d0e2b3eac1a07
SHA512 2a0b7f0cec30682bdbadc3b85ee6549b9bc41f0dc3ce96aff89c9a16dc2f1202652b5807a0443271652f97efdbf6bfd8f40b1752e86cbac9caf8ece55decd1e1
SSDEEP 49152:ppDCH6YdVM2aHA8i0o4BjTYqjzHPqcYO5KQkTq6MV/:poH6YDMtK4FzicYtQV
TLSH
T152D5AE0EFB828C71E59E023A51AA977B4E3AAD205324CDC797B138699D301D2763F395
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

141759

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathStripToRootW PathIsUNCW PathFindFileNameW PathAddBackslashW PathFileExistsW

kernel32

GetVolumeInformationW LockFile SetEndOfFile UnlockFile DuplicateHandle LoadLibraryExW LoadLibraryA GlobalAlloc GlobalLock GlobalUnlock GlobalFree FormatMessageW EncodePointer GetCurrentThreadId FreeLibrary GlobalDeleteAtom lstrcmpW GlobalAddAtomW GlobalFindAtomW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetFileAttributesW SystemTimeToTzSpecificLocalTime SetErrorMode TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc lstrcmpA GlobalFlags LoadLibraryW GetVersionExW CompareStringW GetLocaleInfoW GetCurrentDirectoryW GetUserDefaultLCID UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW CreateDirectoryW GetSystemInfo GetLongPathNameW lstrcpyW GetEnvironmentVariableW GetDriveTypeW WTSGetActiveConsoleSessionId OpenProcess GetExitCodeProcess GetFullPathNameW CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW ReleaseMutex CreateMutexW DeviceIoControl SetPriorityClass VerSetConditionMask RtlUnwind SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP GetFileType HeapQueryInformation ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineA GetCommandLineW ExitProcess GetStdHandle FindFirstFileExW PeekNamedPipe GetStringTypeW GetTimeZoneInformation LCMapStringW IsValidLocale EnumSystemLocalesW SetStdHandle WriteConsoleW IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SwitchToFiber VerifyVersionInfoA GetSystemDirectoryA ExpandEnvironmentStringsA WaitForMultipleObjects SleepEx FormatMessageA GetModuleHandleA SetLastError OutputDebugStringA GetACP MultiByteToWideChar SetConsoleMode ReadConsoleA GetSystemTime FlushFileBuffers GetThreadTimes InitializeCriticalSectionAndSpinCount RaiseException HeapSize HeapReAlloc DecodePointer WideCharToMultiByte RemoveDirectoryW FindResourceW SizeofResource LoadResource LockResource FindNextFileW GetModuleHandleW GetCurrentThread GetCurrentProcess GetProcessHeap HeapFree HeapAlloc LocalFree LocalAlloc GetProcAddress CopyFileW lstrlenW GetSystemDirectoryW MoveFileW FindFirstFileW GetTickCount FileTimeToSystemTime SystemTimeToFileTime FindClose GetLastError DeleteFileW SetFilePointer ReadFile WriteFile GetFileSize GetFileAttributesA SetFileAttributesA CreateFileA DosDateTimeToFileTime FileTimeToDosDateTime LocalFileTimeToFileTime FileTimeToLocalFileTime SetFileTime GetFileInformationByHandle MoveFileExW CreateFileW GetTempPathW OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetModuleFileNameW GetCurrentProcessId GetPrivateProfileIntW WritePrivateProfileStringW GetPrivateProfileStringW CreateEventW CloseHandle Sleep WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CreateThread

user32

wsprintfW PostQuitMessage LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem DestroyMenu RealChildWindowFromPoint ClientToScreen TabbedTextOutW GrayStringW DrawTextExW DrawTextW LoadCursorW GetSysColorBrush ReleaseDC GetDC GetWindowThreadProcessId SetWindowTextW IsWindowEnabled IsWindow GetUserObjectInformationW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongW SetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowRect RemovePropW GetProcessWindowStation GetClientRect SetRectEmpty OffsetRect GetParent CharUpperW GetSystemMetrics GetSubMenu GetMenuItemID GetMenuItemCount SendMessageW GetPropW SetPropW RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetMenu GetMenu EnableWindow GetCapture GetKeyState GetFocus GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos DestroyWindow IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW PostMessageW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW RegisterWindowMessageW GetWindow GetWindowLongW GetWindowTextW GetScrollPos

advapi32

DeregisterEventSource RegisterEventSourceW RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW CryptAcquireContextW CryptReleaseContext CryptGenRandom LookupAccountNameW RegCreateKeyExW RegEnumKeyW GetTokenInformation ImpersonateLoggedOnUser RegOpenKeyW LookupAccountSidW DuplicateTokenEx GetSecurityDescriptorDacl SetSecurityDescriptorDacl GetSecurityDescriptorControl InitializeSecurityDescriptor AddAccessAllowedAce GetAce AddAce GetAclInformation InitializeAcl GetLengthSid EqualSid OpenProcessToken RevertToSelf ReportEventW

shell32

SHGetSpecialFolderPathA SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize

urlmon

URLDownloadToFileW

wininet

HttpQueryInfoW InternetOpenUrlW InternetCloseHandle InternetSetFilePointer InternetReadFile InternetOpenW

cabinet

ord22 ord21 ord20 ord14 ord13 ord11 ord10 ord23

oleacc

CreateStdAccessibleObject LresultFromObject

wtsapi32

WTSQueryUserToken

gdi32

TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx SetMapMode SetTextColor SelectObject SaveDC RestoreDC RectVisible PtVisible CreateBitmap GetDeviceCaps SetBkColor DeleteDC DeleteObject Escape GetClipBox GetStockObject

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

oleaut32

VariantInit VariantClear VariantChangeType

wldap32

ord143 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord301 ord32 ord33 ord35 ord79 ord30 ord200

ws2_32

freeaddrinfo recvfrom sendto accept getaddrinfo ioctlsocket gethostname WSAIoctl socket setsockopt ntohs htons getsockopt getpeername connect closesocket bind WSASetLastError select __WSAFDIsSet WSAGetLastError send recv WSACleanup WSAStartup listen getsockname

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

571KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.giats

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

309KB

Virtual Size

309KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=22, id=241, version=40116,

count=217, id=243, version=40116,

count=31, id=242, version=40116,

count=3, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=6, id=199, version=41118,

count=25, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=2, id=261, version=23013,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=27, id=259, version=24123,

count=39, id=260, version=24123,

count=202, id=261, version=24123,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=796, id=1, productName=Unmarked objects,

count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=79, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,