86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316

Sharing

Copy URL Twitter E-mail

General

Target
86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316
Size 11.6MB
Sample260803-wemxtsxtet
SHA256 86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316
MD5 53890f8f92ffbfddf49bf4b59cddf5b2
SHA1 ec8894c406b9f7fc72dec042591fdbd9e653cd18
SHA512 4b22fca83ad9afc4c01f03e3e7d0ae2bddaa0fbc54bf866d3085abc8ae92cf73b2fd9f3277f39b365029484d48d76d5ce2e234d3a99665b0984ed9229626440f
SSDEEP 196608:V00UXTvyUW/RCjD/RhiNWnwTjuU5TPWg+:V6XTvlwCjjXabTjuUG
TLSH
T1D1C6CE61865C8B4DF07AB038C6875617A7F1BC0C5721DFCB9AD09CB70E2F690F66A609
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316

File Explorer

86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316

.exe 11.6MB

86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316

IMPHASH 29d355a826a3c44a0770282ffc62f94b
SHA256 86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316
MD5 53890f8f92ffbfddf49bf4b59cddf5b2
SHA1 ec8894c406b9f7fc72dec042591fdbd9e653cd18
SHA512 4b22fca83ad9afc4c01f03e3e7d0ae2bddaa0fbc54bf866d3085abc8ae92cf73b2fd9f3277f39b365029484d48d76d5ce2e234d3a99665b0984ed9229626440f
SSDEEP 196608:V00UXTvyUW/RCjD/RhiNWnwTjuU5TPWg+:V6XTvlwCjjXabTjuUG
TLSH
T1D1C6CE61865C8B4DF07AB038C6875617A7F1BC0C5721DFCB9AD09CB70E2F690F66A609
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8820436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionA InternetOpenUrlA HttpOpenRequestA HttpQueryInfoA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

kernel32

SizeofResource MoveFileA GetFileAttributesExA FindFirstFileA SetWaitableTimer GetConsoleScreenBufferInfo CreateNamedPipeA SetConsoleTitleA GetCurrentProcess GetStdHandle CreateWaitableTimerW WriteFile OutputDebugStringA TerminateProcess GetModuleFileNameW GetProcessId FindNextFileA SetThreadPriority ExpandEnvironmentStringsA GetEnvironmentVariableA FindClose CreateMutexA GetVolumeInformationA WaitForSingleObject GetModuleHandleA DisconnectNamedPipe RtlCaptureStackBackTrace OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetModuleHandleExA GetTickCount64 GetLastError AttachConsole GetFileAttributesA Process32NextW QueryFullProcessImageNameA CreateFileA GetCurrentThread LoadLibraryA LockResource DeleteFileA GlobalAlloc Process32FirstW GlobalFree CloseHandle WritePrivateProfileStringA CreateThread GetWindowsDirectoryA LoadResource FindResourceW Module32FirstW GetLocalTime FillConsoleOutputAttribute GetThreadContext GetProcAddress GlobalLock ReadProcessMemory GetCurrentProcessId GetModuleHandleW FreeLibrary WideCharToMultiByte GetConsoleWindow Module32NextW CreateProcessA SetConsoleOutputCP CreateDirectoryA CreateWaitableTimerExW GetTempFileNameA SetConsoleCursorPosition GetPrivateProfileIntA GetPrivateProfileStringA GetTickCount GlobalUnlock AllocConsole IsDebuggerPresent ConnectNamedPipe CheckRemoteDebuggerPresent SetUnhandledExceptionFilter FlushFileBuffers GetExitCodeProcess MultiByteToWideChar GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter CompareFileTime CopyFileA ExitProcess FillConsoleOutputCharacterA GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameA ReadFile HeapReAlloc RtlUnwind IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemTimeAsFileTime SetEnvironmentVariableW SetStdHandle InitializeCriticalSectionEx GetExitCodeThread WaitForSingleObjectEx GetCurrentThreadId SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive GetFileInformationByHandleEx CopyFileW GetProcessHeap HeapSize WriteConsoleW SetEndOfFile ReadConsoleW RtlPcToFileHeader RaiseException LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI

user32

FindWindowW TranslateMessage BringWindowToTop SetWindowLongW SendInput GetCursorPos SetForegroundWindow GetClientRect SetLayeredWindowAttributes EnumWindows GetForegroundWindow MessageBoxA SetWindowDisplayAffinity GetWindowTextA PeekMessageW EmptyClipboard ReleaseCapture UpdateWindow SetClipboardData PostQuitMessage EnumDisplaySettingsW SetFocus keybd_event CloseClipboard GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout LoadCursorW SetCapture SetCursor IsWindowUnicode SetCursorPos GetClipboardData GetWindowThreadProcessId DefWindowProcW MapVirtualKeyW MonitorFromPoint DestroyWindow SetWindowPos GetMonitorInfoW MonitorFromWindow SetActiveWindow CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState OpenClipboard DispatchMessageW FindWindowA

comdlg32

GetOpenFileNameW

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteW ShellExecuteA SHGetFolderPathA ShellExecuteExA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

shlwapi

PathRemoveFileSpecA

winmm

timeBeginPeriod PlaySoundA

dbghelp

SymSetOptions SymInitialize SymFromAddr

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

86f6bca23d03ac9dd3cf1f7ffe173f0ee1983a77f2019720464f202812427316

wininet

ole32

kernel32

user32

comdlg32

advapi32

shell32

d3d11

d3dcompiler_47

winhttp

dwmapi

shlwapi

winmm

dbghelp

imm32

generic