778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a

Sharing

Copy URL Twitter E-mail

General

Target
778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a
Size 2.4MB
Sample260804-2w85aazxav
SHA256 778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a
MD5 1d073735f4b7488aca5957b26b047e9e
SHA1 7300ec1c6227695452e33c60f452f5c4924bd320
SHA512 c4c7d9b834b68ad85a91e3831a2db93fdbbe6b0356ae6846c674853e98419c3ad1f658d7c914939579f9982e2c62a9e4c78444cb18cb87537e35e09e370e2547
SSDEEP 12288:hn43hHAn43hHIoL6gkk3uEn43hHIoL6gkk3u:hnaOnajL5LnajL5
TLSH
T17DB5A521E3ED8A06F6F3AB3C6DB952511E36BD95AE34CA8F0601265D08F0E94DD74723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a

File Explorer

778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a

.dll 2.4MB

778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a

IMPHASH 2f1152304935bf75a3c21dcd1e92ec99
SHA256 778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a
MD5 1d073735f4b7488aca5957b26b047e9e
SHA1 7300ec1c6227695452e33c60f452f5c4924bd320
SHA512 c4c7d9b834b68ad85a91e3831a2db93fdbbe6b0356ae6846c674853e98419c3ad1f658d7c914939579f9982e2c62a9e4c78444cb18cb87537e35e09e370e2547
SSDEEP 12288:hn43hHAn43hHIoL6gkk3uEn43hHIoL6gkk3u:hnaOnajL5LnajL5
TLSH
T17DB5A521E3ED8A06F6F3AB3C6DB952511E36BD95AE34CA8F0601265D08F0E94DD74723
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

crypt32

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddStoreToCollection CertCloseStore CertCreateCertificateChainEngine CertDeleteCertificateFromStore CertDuplicateCertificateContext CertEnumCRLsInStore CertEnumCTLsInStore CertEnumCertificatesInStore CertEnumSystemStore CertFindExtension CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetValidUsages CertNameToStrW CertOpenStore CertOpenSystemStoreW CertRDNValueToStrW CertSaveStore CertSetCertificateContextProperty CertSetEnhancedKeyUsage CryptBinaryToStringA CryptDecodeObjectEx CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptQueryObject PFXExportCertStore

ole32

CreateBindCtx OleCreateDefaultHandler

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_SetBkColor PropertySheetW

comdlg32

GetOpenFileNameW GetSaveFileNameW

user32

DialogBoxParamW EnableWindow EndDialog EnumChildWindows GetClassLongW GetDC GetDlgItem GetParent GetWindowLongPtrW GetWindowRect IsDlgButtonChecked LoadBitmapW LoadImageW LoadStringW MapWindowPoints MessageBoxW PostMessageW ReleaseDC SendMessageA SendMessageW SetFocus SetWindowLongPtrW SetWindowPos ShowScrollBar ShowWindow

gdi32

CreateFontW DeleteObject GetDeviceCaps

advapi32

CryptAcquireContextW CryptDestroyKey CryptGetKeyParam CryptGetUserKey CryptReleaseContext CryptSetProvParam RegCloseKey RegCreateKeyExW RegDeleteValueA RegQueryValueExA RegSetValueExA

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp calloc free fwrite getenv iswprint iswspace malloc memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen wcslen wcsrchr

kernel32

CloseHandle CompareFileTime CreateFileW DelayLoadFailureHook DisableThreadLibraryCalls EnumResourceNamesW FileTimeToSystemTime FindResourceW FormatMessageW FreeLibrary GetDateFormatW GetEnvironmentVariableW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource LocalFree MulDiv MultiByteToWideChar RaiseException ResolveDelayLoadedAPI SizeofResource WriteFile lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

72KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

888KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

778e1985c133d28362fa2f33811c9484bec47e1e41fc6e56324040497c79221a

crypt32

ole32

comctl32

comdlg32

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic