ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e

Sharing

Copy URL Twitter E-mail

General

Target
ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e
Size 14.4MB
Sample260802-vtaelsdk2z
SHA256 ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e
MD5 3d67edd587edda2f412a7050867eb980
SHA1 3fbdfbdcdcf284612a56e1ed1338a3e34b90cc5a
SHA512 9ce8d89ecf67958623767dc79dd279c120a96ea899f397b9ad4afeeb260a214f78c638eed150057dbe364491f62af0b6874916af4ddfa14896b8c6f33bfae7e1
SSDEEP 393216:Vt8rsSzudhrY3EL38/Iq+K2BCTzdXJiov7BZS6jBS2zLJyyZYhE:Vt8osIhrsELM/Iq+K2BCooTu6FP9Y
TLSH
T1B0E63333121C154BD2E54D3DAE33AD707EF12B3B164074B969DC6BEA6C4A9E0E702927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e

File Explorer

ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e

.exe 14.4MB

ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e

IMPHASH 9c5e1b578485bbeb395317f9d103b84f
SHA256 ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e
MD5 3d67edd587edda2f412a7050867eb980
SHA1 3fbdfbdcdcf284612a56e1ed1338a3e34b90cc5a
SHA512 9ce8d89ecf67958623767dc79dd279c120a96ea899f397b9ad4afeeb260a214f78c638eed150057dbe364491f62af0b6874916af4ddfa14896b8c6f33bfae7e1
SSDEEP 393216:Vt8rsSzudhrY3EL38/Iq+K2BCTzdXJiov7BZS6jBS2zLJyyZYhE:Vt8osIhrsELM/Iq+K2BCooTu6FP9Y
TLSH
T1B0E63333121C154BD2E54D3DAE33AD707EF12B3B164074B969DC6BEA6C4A9E0E702927
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

185946192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

imm32

ImmSetCompositionWindow ImmGetConversionStatus ImmGetIMEFileNameA ImmGetProperty ImmGetCompositionWindow ImmSetConversionStatus ImmGetCompositionStringA ImmGetDescriptionA ImmNotifyIME ImmGetDefaultIMEWnd ImmReleaseContext ImmGetContext

dsound

ord2 ord1

dinput8

DirectInput8Create

opengl32

glMatrixMode glLoadIdentity glClear glClearColor glAlphaFunc glFogfv glFogf glViewport glReadPixels glFogi glBlendFunc glTexEnvi wglMakeCurrent wglGetProcAddress wglDeleteContext wglCreateContext glGetString glGetIntegerv glTranslatef glRotatef glFlush glPushAttrib glPopAttrib glPopMatrix glTexSubImage2D glVertex2f glDepthMask glDepthFunc glColor3ub glColor4ub glTexParameteri glTexImage2D glTexEnvf glGenTextures glDeleteTextures glBindTexture glVertex3fv glTexCoord2f glColor3fv glColor3f glVertex3f glEnd glEnable glDisable glColor4f glBegin glPushMatrix glGetFloatv

glu32

gluPerspective gluOrtho2D

winmm

mmioRead mmioClose mciSendStringA mmioOpenA timeGetTime mmioDescend mmioAscend

ws2_32

select setsockopt socket shutdown gethostbyname WSAStartup WSACleanup getpeername WSASetLastError htonl getservbyname gethostbyaddr getservbyport getsockopt recvfrom inet_addr htons ioctlsocket connect closesocket WSAAsyncSelect ntohs inet_ntoa getsockname send WSAGetLastError recv __WSAFDIsSet sendto

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

kernel32

CloseHandle AddVectoredExceptionHandler RemoveVectoredExceptionHandler QueryPerformanceCounter QueryPerformanceFrequency SetEvent WaitForSingleObject CreateEventA OpenEventA GetCurrentProcess GetCurrentProcessId ExitProcess CreateThread OpenThread SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext GetTickCount GetTickCount64 VirtualProtect VirtualQuery ReadProcessMemory CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer GetModuleFileNameA GetModuleHandleA GetModuleHandleExA lstrcmpiA lstrcpyA CreateToolhelp32Snapshot Thread32First Thread32Next DecodePointer GetLastError InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar Sleep GetCurrentThread IsBadReadPtr WriteFile MapViewOfFile UnmapViewOfFile CreateFileMappingA SetUnhandledExceptionFilter GlobalMemoryStatus lstrcpynA Process32First Process32Next Module32First Module32Next GetFileSize ReadFile DeleteFileA FindClose FileTimeToSystemTime GetNumberFormatA GlobalUnlock GlobalLock lstrlenA GetExitCodeThread GetLocalTime InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetFilePointer VerSetConditionMask GlobalMemoryStatusEx GetSystemInfo GetSystemDirectoryA GetVersionExA FreeLibrary GetProcAddress LoadLibraryA LoadLibraryW VerifyVersionInfoW GetStdHandle SetLastError SetConsoleMode GetCommandLineA GetCurrentDirectoryA IsBadWritePtr K32GetMappedFileNameA WideCharToMultiByte CreateFileA GetEnvironmentVariableW VirtualFree CreateSemaphoreA ReleaseSemaphore GetModuleHandleExW GetFileType TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared ReleaseSRWLockShared InitializeSRWLock FindNextFileW FindFirstFileW CreateFileW GetTimeZoneInformation GetModuleFileNameW GetCurrentDirectoryW GetFullPathNameW GetOEMCP GetACP GetSystemTime SystemTimeToFileTime RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess UnhandledExceptionFilter IsProcessorFeaturePresent GetCPInfo GetStringTypeW GetModuleHandleW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive GetCurrentThreadId FormatMessageA ReadConsoleA ReadConsoleW RtlUnwind InitializeCriticalSectionAndSpinCount LoadLibraryExW ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime HeapFree GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapAlloc FlsAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive LCMapStringEx FlsGetValue FlsSetValue FlsFree EncodePointer CompareStringW LCMapStringW WriteConsoleW SetEndOfFile HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW IsValidCodePage FindFirstFileExW HeapReAlloc FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetConsoleMode GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers VirtualQuery GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation SetWindowPos GetWindowRect MessageBoxA ClientToScreen EnumDisplaySettingsA FindWindowA AdjustWindowRect EndPaint BeginPaint ReleaseDC ReleaseCapture SetCapture PostQuitMessage GetMessageA GetKeyboardLayout GetKeyboardLayoutNameA PeekMessageA DispatchMessageA TranslateMessage GetCaretPos GetWindowTextA GetScrollPos SetScrollPos GetDC GetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetRect SetCursorPos IntersectRect GetAsyncKeyState GetFocus SetFocus ScreenToClient GetCursorPos GetActiveWindow GetDoubleClickTime PtInRect PostMessageA SystemParametersInfoA LoadCursorA SetClassLongA GetClassLongA SetWindowLongA GetWindowLongA SetCursor ShowCursor GetClientRect SetForegroundWindow UpdateWindow GetSystemMetrics KillTimer DestroyWindow CreateWindowExA RegisterClassA DefWindowProcA LoadIconA SetWindowTextA SetTimer ShowWindow CallWindowProcA SendMessageA wsprintfA ChangeDisplaySettingsA CharUpperBuffW

gdi32

CreateFontA DeleteObject GetTextExtentPointA CreateCompatibleDC CreateFontIndirectA DeleteDC GetTextExtentExPointA SelectObject SetBkMode SetTextColor SetTextAlign CreateDIBSection TextOutA SetBkColor GetTextExtentPoint32A SetPixelFormat GetStockObject ChoosePixelFormat SwapBuffers

advapi32

RegisterEventSourceW RegCloseKey RegCreateKeyExA RegQueryValueExA RegSetValueExA CryptReleaseContext CryptGenRandom CryptEnumProvidersW CryptAcquireContextW CryptGetProvParam CryptExportKey CryptSignHashW CryptDecrypt CryptSetHashParam ReportEventW DeregisterEventSource CryptGetUserKey CryptCreateHash CryptDestroyHash CryptDestroyKey

shell32

ShellExecuteA Shell_NotifyIconA

ole32

OleUninitialize CoInitialize OleInitialize CoCreateInstance

oleaut32

SysAllocString VariantInit VariantClear

wininet

InternetReadFile InternetOpenUrlA InternetOpenA InternetCloseHandle

crypt32

CertCloseStore CertGetCertificateContextProperty CertFreeCertificateContext CertOpenStore CertOpenSystemStoreW CertFindCertificateInStore CertEnumCertificatesInStore CertDuplicateCertificateContext

.�{��J��"�qm��9��t^��^K��e�@%9��k�<�ϧM��:\�x(;�.�#�_+.ѧ\��"�A~P;$B�%=@Xpo�^]�45�9��1��I��tB��]�;�G0��TOψda��Ϋ��Ǹ�6Qa��c��D�y~��Z��p�-,��%V�Cr�܆��h�s�n��$��gT�:��o�,E:��2�0��7M��DIY:�r��nop��?A��Q2IY��ܠ��)��lG�v�� r�!=�O��j;Ho�գrd+@L'�Xظя�>��`nl��F�;�k�ڭ�4��0�&�hh�Z��$q�A�ô1��QSϑ��t s��O��y�V�S��U~n��J�#��"��U��OH��2H�4_Qp��aq��I��Q%=�E��[�te��3��]��+2��t��v"��{ǶSʥ�� k��;z�`�Y��ե�L�Q,��]�l\�.��D��Nk��I�,�kL�E��e�^�}f,oj�/�=�6��V��H�Ty�=��x`�j� ��h/��#U�i�G��^(��=[�v[�P�A'c��q�؊0��<4�,Ç��wC@څ�*#>s��jI5,X�N�y3Z�`ڭ��z��^�/�eWU$_5�VF"�qrQ#��+E�n�h! �i\�jI7*��˄[�.�~t��^�}��Xk�%�1�_��͸R.�� -��0:�D��A�.�۾��t��Y��v.(� �J��YF�5}��!F�^�#OB�!j��h��Q��!G0$�iww1Z��L �ߤ|��R�;��$�md�S�`pS&֫8^-�H�*��T��n��"�[m1��Y�֪7�Py,"�� a&B�0h��q!�S�Rĥ��M�s� f��ǃ�� (��6��P҈ʺ]�3"��G�Nv�t@��L\cp��K��3�T{�W��4He��h�p�@O"}��;��QMд��q�Q��{kMŉ`�a\��3j�r z�*��!�z�L3o;c[Or8`QTE��F��ܷS�+��"�G`&2��M�2�]g;!�<p��[@�� n��9�̳��@J��/7J��vN��wY��<��>��<J�@ �de �{8 ꥅ�7qe��a�z(��^D��9+��5��h24m��)7�&��k@�C�u�I�!^'��}��b"��U�j�0�D��Kf�^�9�͎ۊ%��3��k�*��7#]]�X�gg��wN�,�4D[e�N]��N��-L��m:'�t�q��r�oaDL��kU�u�:��_��,4K�PU��O��B��<#��0��rf�GC��)��Fn𾽃>74f�IԔ��s��Bs�9j��받��w=aCrx�}ݭK�lV��Y��VX��R��Y�G��b�F��&f�wB%�M��. =!�3vq�&l��ܑų8 }��L`8��R�� _)��횲��ç�g�sx?0��L�̞�V�`/�Y�%#zB �X;�(�"B�� ˝4��z[�6��ֺ_��O��3�b��.��V|h�b��Ä ��/VE�"��*�ۗ�O��{�*��g��+E=�쌦��!fV%�c�<as�H^�?S��u��y �l�_q��>�$FX'�WZ�c.W��:xI��)�J3e�H��I�`��X��2�q��;�.+�Vz\�}`Ƌ�dVx��G��h0I ��вv��j�n�~|��g ��Q�A8w�k_�D%֤*�[�w�΄+qb0zEY�z��*S-ɦ�Z��h%�P��^��hD��Z G�4��up�{,E��ħ8�%/��+�+�z��ꋛA�)c�2څ��#Ct�[��*'�=A��܁�-�*:2$��Q�o�p�Ba^�`��|��ؽN��b ~'�� M��8��D��{�@qN�4QX��<�3�s�.b�pP��f��1MH��Ѡ��0��Q�6� L�͘��v}Y-FV�:��l�|�hx9��}�P��p�w��2��Z45"]�w^_L��<��f=��">03ЫHWp2l�\��G�Q��-3��YG�w ?¨25a�6J��ڟ��ÿ�q`z��Ӏ�ز萳��jtB��t��1��%��0d��\� T�"X��Q�!X�W��D~\54L�V6��&}��<��c��{ul��r��&��&H��^W��]J��eD��J��*zO8��S�Ⱛm��=��7ֱ�m��lK�^v��2W��*�h�D ��W�ҁ�|$O�Y��)��ী��e�D�{�å� Z!��M�C��C6oՃ�N.��<��IM�;C!��J��KtH0�Sas=��j�] �\Gw��;K�.��+��]��7��lH"�R;�!��9=x�k>n�U�-�1�@��>8%7,r_��؞ӱ<�/R�i,# Nv��`��蜸�v��.Z��`o�e,uT��- �Գ��]��H�eS�t��݇Ry�Z��୞6�ZV��A�d:<�w�e��W8G`i��FWE��J��p!��f��⍤��@�?s.zZ�A��㰮%g�?�o;3%@iV݌ק4+�dy��ܚE�M��p=ZPG��) b��C�/YB��oB�C�q#HR�m|⨌��,��U-�C�s�~Sek�� 3�K��_Q�� '��@v�Q#�q�Z��9y�g��SF�(��־�F[�Kq-�(��Y3�+�q��`#��;O��j��ɜ�=�O��եq��x�7�ͽwlnC��J!�&��6sg��tc��tC�a�E�*7W+(�1� �

Name

.text

Size

9KB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

145.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.g98

Size

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdatae

Size

14.2MB

Virtual Size

14.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.w8x

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.pdata_6

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.96mjw

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ead2d4e75126b525d8923a6f695b7ca3e985c9ea9f8f33b8af10a62cb131fc0e

imm32

dsound

dinput8

opengl32

glu32

winmm

ws2_32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

crypt32

generic