418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4

Sharing

Copy URL Twitter E-mail

General

Target
418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4
Size 504KB
Sample260804-22e4dsaa98
SHA256 418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4
MD5 9ec6796b9b45ec959c7158af2c6166bf
SHA1 74cd8f0e4e87aa62f5aac8fa402ea782e116655f
SHA512 f76c0ad9de14c7fce5fea35ca901fada337d0af41358d62fa08fbfaa26f37c6dda6a28832d5bcf75c7052bacab915627eb96c93136e4cfd8e7eb8b76b3cb6116
SSDEEP 6144:6ZowMMKCd9kGzHZowMMKCd9kGzHZowMMKCd9kGz:mnMMKUkWnMMKUkWnMMKUk
TLSH
T130B42D01B3F99664F6F34B30287962A54A7ABE126FA0C5CF1B44255D4E72BD0EA34373
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4

File Explorer

418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4

.dll 504KB

418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4

IMPHASH a0d52830c1f9f5fd42a41eac92b791f9
SHA256 418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4
MD5 9ec6796b9b45ec959c7158af2c6166bf
SHA1 74cd8f0e4e87aa62f5aac8fa402ea782e116655f
SHA512 f76c0ad9de14c7fce5fea35ca901fada337d0af41358d62fa08fbfaa26f37c6dda6a28832d5bcf75c7052bacab915627eb96c93136e4cfd8e7eb8b76b3cb6116
SSDEEP 6144:6ZowMMKCd9kGzHZowMMKCd9kGzHZowMMKCd9kGz:mnMMKUkWnMMKUkWnMMKUk
TLSH
T130B42D01B3F99664F6F34B30287962A54A7ABE126FA0C5CF1B44255D4E72BD0EA34373
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VariantClear VariantInit

ole32

CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CreateStreamOnHGlobal HMENU_UserFree HMENU_UserMarshal HMENU_UserSize HMENU_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal

user32

ChildWindowFromPointEx ClientToScreen GetAncestor GetClientRect GetGUIThreadInfo GetWindow GetWindowLongW GetWindowThreadProcessId IsChild IsWindow IsWindowVisible LoadStringA LoadStringW MapWindowPoints RealGetWindowClassW ScreenToClient SendMessageW WindowFromPoint

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsicmp calloc free fwrite getenv memcmp memcpy memmove strchr strcmp strcpy strcspn strlen wcslen wcstoul

kernel32

CloseHandle CreateFileMappingW DisableThreadLibraryCalls DuplicateHandle EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFree GlobalGetAtomNameW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MapViewOfFile MultiByteToWideChar OpenProcess RaiseException SizeofResource UnmapViewOfFile WideCharToMultiByte

ntdll

_vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

418eb7d4ab4191086ab1f659210da8433a6142c9465301712a5e34fc159f3fb4

oleaut32

ole32

user32

rpcrt4

ucrtbase

kernel32

ntdll

generic