52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1

Sharing

Copy URL Twitter E-mail

General

Target
52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1
Size 5.1MB
Sample260801-2134tsab76
SHA256 52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1
MD5 86fdb950678dff8d93c911853814d8f5
SHA1 175801c3ce92940e7aa1da334801f1e36fbe20c3
SHA512 20be4dae65a99d4e5053c03d13eec815d40542922f2d16b2e3eecb793ca0c4cd12dea3eae0b9d026bfdec3cb513be3260660c010ff0c5a88bf344a5fad287e34
SSDEEP 98304:/MMM4yf6n1DAdY9DX9jVeqH4k0AOMMMQXVRQj8pt94xEGTAxe5oUPYMG2cfC6:nyf6n1kdY9DXdVeqH4k0AKX/48pt94xy
TLSH
T1BA368D1178408175EBA14176E9BEFE6A089DDE710B3865C3A3D86D1E3EB41D31F322A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1

File Explorer

52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1

.exe 5.1MB

52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1

IMPHASH e1982d913cbf8846f78d73f196a2b909
SHA256 52eb12295abe5835f4c62a9363b7614c443799096d04ebfe3f7a64da71123cc1
MD5 86fdb950678dff8d93c911853814d8f5
SHA1 175801c3ce92940e7aa1da334801f1e36fbe20c3
SHA512 20be4dae65a99d4e5053c03d13eec815d40542922f2d16b2e3eecb793ca0c4cd12dea3eae0b9d026bfdec3cb513be3260660c010ff0c5a88bf344a5fad287e34
SSDEEP 98304:/MMM4yf6n1DAdY9DX9jVeqH4k0AOMMMQXVRQj8pt94xEGTAxe5oUPYMG2cfC6:nyf6n1kdY9DXdVeqH4k0AKX/48pt94xy
TLSH
T1BA368D1178408175EBA14176E9BEFE6A089DDE710B3865C3A3D86D1E3EB41D31F322A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3150161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MHClient-Connect.pdb

soundlib

CreateSoundLib

winmm

waveOutReset waveInGetNumDevs waveInOpen waveInClose waveOutWrite waveInAddBuffer waveInStart waveInStop waveInReset waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetNumDevs timeGetTime waveInPrepareHeader

ss3dgfunc

_VECTOR3Length@4 BeginAnalyze _SetInverseMatrix@8 EndAnalyze _CrossProduct@12 _COLORtoDWORD@16 _WriteTGA@24 _Normalize@8 _SetRotationYMatrix@8 _SetRotationXMatrix@8 _TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16

wsock32

closesocket connect inet_ntoa getsockopt htons recv __WSAFDIsSet bind inet_addr WSAGetLastError WSACleanup WSAStartup socket setsockopt getsockname send gethostbyname sendto recvfrom ntohs ioctlsocket select

dinput8

DirectInput8Create

ws2_32

WSAIoctl inet_pton

wininet

HttpOpenRequestA InternetConnectA InternetReadFile InternetOpenUrlA InternetCloseHandle InternetOpenA HttpSendRequestA

kernel32

GetConsoleMode HeapSize EnumSystemLocalesW GetConsoleCP IsValidCodePage GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW CreateSemaphoreW GetStartupInfoW CreateEventW SetLastError GetFileSize CloseHandle GetLocalTime OpenFile LoadLibraryA MultiByteToWideChar IsDBCSLeadByte CreateDirectoryA InterlockedExchange InterlockedCompareExchange GetProcAddress GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId SuspendThread ResumeThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep WriteFile DuplicateHandle GetTickCount GetModuleFileNameA CreateFileA SetFileAttributesA GetFileAttributesA DeleteFileA OpenProcess TerminateProcess ReadFile CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte LCMapStringA GetSystemDefaultLangID GetSystemFirmwareTable DeviceIoControl InterlockedDecrement VirtualQuery GetSystemInfo GetModuleFileNameW GetModuleHandleA GetEnvironmentVariableW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW CreateFileW IsWow64Process GlobalAlloc GlobalLock GlobalUnlock GlobalFree lstrlenA SetCurrentDirectoryA GetCurrentDirectoryA Module32First Module32Next GetACP lstrcpyA OutputDebugStringA FreeLibrary HeapAlloc HeapFree GetProcessHeap GetLastError SystemTimeToFileTime CompareFileTime lstrcmpiA GetOEMCP GetTickCount64 CreateEventA GetModuleHandleW ReadConsoleW Process32FirstW Process32NextW ExitProcess FindNextFileW SetThreadPriority WriteProcessMemory GetThreadContext SetThreadContext IsDebuggerPresent CheckRemoteDebuggerPresent ReleaseMutex FindClose MapViewOfFile UnmapViewOfFile CreateMutexA CreateFileMappingA OpenFileMappingA RemoveDirectoryA FindFirstFileA FindNextFileA CopyFileA MoveFileA SetUnhandledExceptionFilter DecodePointer RaiseException InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetPrivateProfileStringA WritePrivateProfileStringA lstrcatA GetLogicalDriveStringsA GetTempPathA QueryDosDeviceA QueryPerformanceCounter QueryPerformanceFrequency IsBadReadPtr GetVersionExA GlobalMemoryStatusEx OpenMutexW GetDiskFreeSpaceExW GetFileAttributesW GetComputerNameW GetSystemTime UnhandledExceptionFilter GetCPInfo FatalAppExitA WriteConsoleW GetFileType GetStdHandle GetCommandLineA AreFileApisANSI GetModuleHandleExW LoadLibraryExW ExitThread HeapReAlloc FileTimeToSystemTime SystemTimeToTzSpecificLocalTime UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation TlsFree TlsSetValue TlsGetValue TlsAlloc GetThreadPriority SwitchToThread FlushFileBuffers SignalObjectAndWait WaitForSingleObjectEx RtlCaptureStackBackTrace QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList CreateTimerQueue IsProcessorFeaturePresent RtlUnwind GetStringTypeW EncodePointer GetExitCodeThread GetSystemTimeAsFileTime SetConsoleCtrlHandler GetFileAttributesExW CreateDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WaitForMultipleObjectsEx QueryFullProcessImageNameW SetFilePointerEx OutputDebugStringW GetThreadTimes FreeLibraryAndExitThread ReleaseSemaphore InitializeSListHead UnregisterWaitEx GetVersionExW VirtualAlloc VirtualFree VirtualProtect SetProcessAffinityMask LoadLibraryW GetTimeZoneInformation FindFirstFileExW SetEvent SetEnvironmentVariableA SetEndOfFile LocalFree lstrlenW lstrcmpA ReadProcessMemory

user32

OffsetRect wsprintfA SetRect MessageBoxA EnumDisplaySettingsA CharNextA CharPrevA OpenClipboard CloseClipboard GetWindow GetWindowThreadProcessId GetTopWindow SetClipboardData EmptyClipboard FindWindowExA EnumChildWindows GetWindowLongA GetWindowTextW IsWindowVisible IsWindow EnumDisplayDevicesW CopyRect PostMessageA mouse_event GetClipboardData IsClipboardFormatAvailable SetCapture ReleaseCapture GetCursorPos ScreenToClient EndDialog GetDC ReleaseDC TranslateMessage DispatchMessageA PeekMessageA DefWindowProcA RegisterClassExA CreateWindowExA ShowWindow GetSystemMetrics UpdateWindow ShowCursor FindWindowW LoadIconA GetDesktopWindow SendMessageA GetAsyncKeyState GetClientRect LoadCursorFromFileA SetCursor UnregisterClassA GetMonitorInfoW MonitorFromWindow

gdi32

BitBlt RemoveFontResourceExA AddFontResourceExA SelectObject GetTextExtentPoint32A DeleteObject CreateFontIndirectA CreateCompatibleBitmap CreateCompatibleDC CreateDCW DeleteDC GetStockObject

advapi32

OpenTraceW EnableTrace ControlTraceW StartTraceW CheckTokenMembership RegQueryValueExA RegQueryInfoKeyA RegOpenKeyExA RegCloseKey ProcessTrace CloseTrace OpenThreadToken LookupPrivilegeValueA CloseEventLog GetNumberOfEventLogRecords OpenEventLogW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW FreeSid AllocateAndInitializeSid OpenProcessToken RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoInitializeEx CreateStreamOnHGlobal CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoFreeUnusedLibraries CoInitialize CoUninitialize

oleaut32

SysAllocString SysFreeString GetErrorInfo VariantChangeType SetErrorInfo VariantClear CreateErrorInfo VariantInit

freeimage

_FreeImage_ConvertTo16Bits565@4 _FreeImage_GetInfo@4 _FreeImage_GetBits@4 _FreeImage_Unload@4 _FreeImage_SaveJPEG@12 _FreeImage_Save@16 _FreeImage_Load@12 _FreeImage_GetScanLine@8 _FreeImage_Allocate@24

iphlpapi

GetAdaptersInfo

wintrust

WinVerifyTrust

psapi

GetModuleInformation GetMappedFileNameW GetProcessImageFileNameA GetModuleFileNameExA GetModuleFileNameExW EnumProcessModules

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash

tdh

TdhGetPropertySize TdhGetEventInformation TdhGetProperty

gdiplus

GdipAlloc GdipDisposeImage GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToStream

d3d11

D3D11CreateDevice

generic

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=199, version=41118,

count=67, id=223, productName=VS2013 build 21005, version=21005,

count=149, id=225, productName=VS2013 build 21005, version=21005,

count=257, id=224, productName=VS2013 build 21005, version=21005,

count=132, id=224, productName=VS2013 UPD4 build 31101, version=31101,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=2, id=221, productName=VS2013 UPD5 build 40629, version=40629,

count=36, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=423, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=687, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=220, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,