9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c

Sharing

Copy URL Twitter E-mail

General

Target
9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c
Size 637KB
Sample260802-tkf1cscd74
SHA256 9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c
MD5 10339d879845fce78a1875276e35a0ee
SHA1 8df6354a1088c8926dacf0a1b7b6e5710f01512a
SHA512 89ac4eb324fd5f40e89eca80c39ef5c9cb55f1bf06bee779a28ae29078d3f81f1a27534ab86a95fb23b259a4f15a0b160d0d4b4897459267ca047e1ce335ce75
SSDEEP 12288:JgkbzVooludAmtpQ575cAXuTleovFjRh:N7saHjXIeKFjH
TLSH
T14CD43A12A7F803A9F2B3D77599724902EA767C461734D5DF4390986A0F33AD48E3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c

File Explorer

9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c

.exe 637KB

9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c

IMPHASH b05176c4e12a746dc7e01ce4ab112c8e
SHA256 9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c
MD5 10339d879845fce78a1875276e35a0ee
SHA1 8df6354a1088c8926dacf0a1b7b6e5710f01512a
SHA512 89ac4eb324fd5f40e89eca80c39ef5c9cb55f1bf06bee779a28ae29078d3f81f1a27534ab86a95fb23b259a4f15a0b160d0d4b4897459267ca047e1ce335ce75
SSDEEP 12288:JgkbzVooludAmtpQ575cAXuTleovFjRh:N7saHjXIeKFjH
TLSH
T14CD43A12A7F803A9F2B3D77599724902EA767C461734D5DF4390986A0F33AD48E3A723
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord410 ord413 ord381 InitCommonControlsEx ord412

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

comdlg32

GetSaveFileNameW

msimg32

AlphaBlend

winmm

PlaySoundW

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

user32

TranslateMessage LoadIconW FindWindowW KillTimer PostQuitMessage SetTimer DispatchMessageW RegisterClassExW GetWindowLongPtrW CreateWindowExW SetWindowLongPtrW DestroyWindow DefWindowProcW GetMessageW SetForegroundWindow GetForegroundWindow GetWindowRect SetCursor LoadCursorW EndPaint BeginPaint GetCursorPos ReleaseDC GetWindowThreadProcessId IsWindowVisible EnumWindows IsIconic EnumDisplayMonitors GetIconInfo IsWindow GetCursorInfo RegisterClipboardFormatW OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData IsClipboardFormatAvailable UnregisterHotKey RegisterHotKey GetSystemMetrics RegisterWindowMessageW PostMessageW MessageBoxW InvalidateRect SendMessageW UpdateWindow SetLayeredWindowAttributes GetWindowTextLengthW SendDlgItemMessageW GetDlgItemInt GetDlgItem GetWindowTextW SetDlgItemTextW MapVirtualKeyW GetFocus CallNextHookEx SetWindowTextW MessageBeep GetAsyncKeyState UnhookWindowsHookEx SetWindowsHookExW GetKeyNameTextW GetClassNameW GetScrollInfo SetScrollInfo FrameRect MonitorFromRect MapWindowPoints GetCaretBlinkTime ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetWindow AdjustWindowRectEx IsDialogMessageW IsWindowEnabled EnableWindow GetClientRect DrawIconEx MonitorFromPoint DestroyIcon GetMonitorInfoW PtInRect OffsetRect FillRect DrawTextW SetWindowPos SetActiveWindow ShowWindow SetFocus CreatePopupMenu DestroyMenu TrackPopupMenuEx AppendMenuW ReleaseCapture GetKeyState InflateRect GetDC GetDpiForWindow SetCapture LoadImageW

gdi32

CreateDIBSection SetBkColor RoundRect PatBlt GetTextMetricsW GetWorldTransform SetGraphicsMode Chord SetWorldTransform GetStockObject LineTo CreatePen Rectangle Polygon MoveToEx Ellipse SetROP2 SetBrushOrgEx SaveDC RestoreDC IntersectClipRect GetObjectW StretchBlt SetTextColor SetBkMode SetStretchBltMode CreateSolidBrush CreateFontIndirectW BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject

shell32

DragAcceptFiles CommandLineToArgvW Shell_NotifyIconW SHChangeNotify DragQueryFileW ShellExecuteW DragFinish SHGetKnownFolderPath

advapi32

GetUserNameW RegSetKeyValueW RegCreateKeyExW RegCloseKey RegDeleteTreeW RegGetValueW

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute

windowscodecs

WICConvertBitmapSource

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

shlwapi

ord12 SHCreateStreamOnFileEx

uxtheme

SetWindowTheme

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentProcessId GetComputerNameW GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW DeleteFileW FindClose FindNextFileW FindFirstFileW GlobalUnlock GlobalLock GlobalFree GlobalAlloc GlobalSize OutputDebugStringW GetFileAttributesW GetModuleFileNameW CreateDirectoryW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetDateFormatEx WriteConsoleW GetTimeFormatEx GetModuleHandleW GetProcAddress LoadResource FindResourceExW LockResource GetUserDefaultUILanguage SizeofResource MulDiv GetLocalTime Sleep LocalFree CloseHandle GetLastError CreateMutexW GetCommandLineW LCMapStringW GetProcessHeap VirtualProtect WakeAllConditionVariable CreateFileW SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode LoadLibraryExW

oleaut32

VariantInit

Name

.text

Size

374KB

Virtual Size

374KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9bb56235a26313097f8a57661ac35a4ba4fe05e5ebd8de84483afc09383ed71c

comctl32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

comdlg32

msimg32

winmm

imm32

user32

gdi32

shell32

advapi32

api-ms-win-shcore-scaling-l1-1-1

dwmapi

windowscodecs

ole32

shlwapi

uxtheme

kernel32

oleaut32

generic