6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c

Sharing

Copy URL Twitter E-mail

General

Target
6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c
Size 4.6MB
Sample260804-h1jweafa62
SHA256 6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c
MD5 185f94365306723ee4805ac1c4e74b78
SHA1 446499172b01d13b321ca906b262981a6a11e543
SHA512 bb7a5e09c76ea9c15b626af5c966db3a4fba38aeaec4475a2c8ae02c16932fbae0e9e517e739be3bd9af6ab65d5970426c484aa2af783df75d2ec0abb8873b7c
SSDEEP 98304:JNDWLixwOydqjideT5x0QAGQepkcU8mkCOsHbE9HKjao45P:JN6dOydqjfCG5kcEkl9ZbP
TLSH
T10226BF21BBD2C17AE8F202719B7DAB9F102CBE251B2940EB72D8195D19707D32B36717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c

File Explorer

6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c

.exe 4.6MB

6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c

IMPHASH 277b6e27b5785f425f2394d28495d60e
SHA256 6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c
MD5 185f94365306723ee4805ac1c4e74b78
SHA1 446499172b01d13b321ca906b262981a6a11e543
SHA512 bb7a5e09c76ea9c15b626af5c966db3a4fba38aeaec4475a2c8ae02c16932fbae0e9e517e739be3bd9af6ab65d5970426c484aa2af783df75d2ec0abb8873b7c
SSDEEP 98304:JNDWLixwOydqjideT5x0QAGQepkcU8mkCOsHbE9HKjao45P:JN6dOydqjfCG5kcEkl9ZbP
TLSH
T10226BF21BBD2C17AE8F202719B7DAB9F102CBE251B2940EB72D8195D19707D32B36717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2334611

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

tvpwin32.pdb

kernel32

VirtualQuery FindResourceW LoadResource IsBadReadPtr OpenProcess GlobalAlloc Sleep SizeofResource GetVersionExW GlobalFree LockResource GlobalMemoryStatusEx SetCurrentDirectoryW HeapSetInformation GetCurrentThreadId GetSystemTime CreateMutexW HeapQueryInformation GetProcessHeaps HeapWalk LoadLibraryExW GetNativeSystemInfo HeapAlloc HeapFree VirtualFree SetLastError VirtualAlloc LoadLibraryA VirtualProtect GetConsoleMode FreeConsole WriteConsoleW GetLocalTime SetConsoleTitleW GetProcessAffinityMask SetThreadAffinityMask GlobalMemoryStatus TerminateProcess GetCurrentThread SetThreadPriority GlobalDeleteAtom GlobalAddAtomW MulDiv OutputDebugStringW FormatMessageW SearchPathW GetSystemDirectoryW GetWindowsDirectoryW WideCharToMultiByte IsDBCSLeadByte MultiByteToWideChar GlobalLock GlobalUnlock InterlockedIncrement InterlockedDecrement WaitForSingleObject InterlockedCompareExchange SetEvent ExitThread CreateEventW SetThreadIdealProcessor GetSystemInfo GetThreadPriority SuspendThread ResumeThread CreateThread HeapDestroy HeapCreate LocalSize GetTempFileNameW SetProcessAffinityMask SetEnvironmentVariableA GetExitCodeProcess GetCurrentDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation GetFileType GetFileAttributesExW InitializeSListHead GetOEMCP GetACP IsValidCodePage HeapSize EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStartupInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount GetCPInfo RaiseException RtlUnwind GetCommandLineA GetSystemTimeAsFileTime GetThreadTimes DeleteFileA AreFileApisANSI GetModuleHandleExW HeapReAlloc IsProcessorFeaturePresent IsDebuggerPresent DecodePointer EncodePointer GetStringTypeW ExitProcess GetFullPathNameW LocalFree LocalLock LocalUnlock GetVolumeInformationW GetCurrentProcessId DeleteFileW RemoveDirectoryW GetTempPathW GetFileAttributesW CreateFileW GetTickCount CreateDirectoryW SetEndOfFile GetDriveTypeW SetFilePointer GetFileSize CloseHandle DuplicateHandle CreatePipe SetStdHandle GetStdHandle FlushFileBuffers GetModuleFileNameW ReadFile WriteFile GetCurrentProcess CreateProcessW FindNextFileW FindClose GetProcAddress LoadLibraryW FreeLibrary FindFirstFileW GetLastError GetModuleHandleW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetProcessHeap SetEnvironmentVariableW HeapCompact

user32

SetTimer ReleaseDC GetDC ChangeDisplaySettingsW MessageBoxW GetSysColor SetWindowPos GetParent GetWindowRect DefWindowProcW CreateWindowExW SetWindowLongW GetWindowLongW RegisterClassExW GetClassInfoExW PostMessageW DestroyWindow GetWindowThreadProcessId SendMessageW SystemParametersInfoW EnumDisplaySettingsW LoadCursorFromFileW PostQuitMessage KillTimer CloseClipboard GetPriorityClipboardFormat IsClipboardFormatAvailable GetClipboardData OpenClipboard SetClipboardData LoadStringW ClientToScreen SetWindowRgn SetCapture GetCursorPos EnumWindows GetFocus EnumDisplaySettingsExW SetFocus GetForegroundWindow GetKeyboardLayout SetCursorPos MonitorFromWindow DestroyCaret CreateCaret SetCaretPos EndPaint GetWindowTextLengthW GetSystemMenu ScreenToClient SetActiveWindow GetMessageExtraInfo GetKeyState TrackMouseEvent IsWindowEnabled GetClientRect BeginPaint SetPropW GetCapture GetMenu LoadIconW SetRect InvalidateRect GetWindowTextW GetMenuItemCount AdjustWindowRectEx ReleaseCapture IsWindowVisible UpdateWindow SetWindowTextW SetCursor LoadCursorW WindowFromPoint GetCursor DialogBoxParamW GetDlgItem EndDialog SetDlgItemTextW EnableWindow TranslateAcceleratorW DestroyAcceleratorTable IsIconic CreateAcceleratorTableW WaitMessage TranslateMessage LoadAcceleratorsW PeekMessageW ShowWindow DispatchMessageW GetAsyncKeyState GetSystemMetrics GetMonitorInfoW

gdi32

EnumFontFamiliesExW GetStockObject GetTextMetricsW CreateFontIndirectW SelectObject GetFontData DeleteObject GetObjectW ExtCreateRegion CreateRectRgn GetTextExtentPoint32W GetOutlineTextMetricsW GetGlyphOutlineW GetDeviceCaps CreateCompatibleDC CreateDIBSection EnumFontsW DeleteDC CreateDIBitmap GetPixel CombineRgn SetPixel CreateCompatibleBitmap

comdlg32

GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetSpecialFolderPathW DragFinish SHGetPathFromIDListW ShellExecuteW DragQueryFileW DragAcceptFiles SHBrowseForFolderW

ole32

CLSIDFromString CoTaskMemFree CoCreateGuid CoTaskMemAlloc StringFromGUID2

winmm

timeEndPeriod timeGetTime timeGetDevCaps timeBeginPeriod

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

mpr

WNetGetUniversalNameW

shlwapi

PathIsDirectoryW PathFileExistsW

imm32

ImmGetContext ImmGetOpenStatus ImmIsIME ImmSetCompositionFontW ImmSetConversionStatus ImmSetOpenStatus ImmAssociateContext ImmGetConversionStatus ImmSetCompositionWindow ImmReleaseContext

dbghelp

MiniDumpWriteDump

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.adata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

722KB

Virtual Size

721KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

681KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

737KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

214KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.bind

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6b21dac286f07f755f10ea96e502c7361ba5c226220ff4ecc7df7304eff73c8c

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

winmm

version

mpr

shlwapi

imm32

dbghelp

generic