7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9

Sharing

Copy URL Twitter E-mail

General

Target
7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9
Size 346KB
Sample260804-lprzesha25
SHA256 7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9
MD5 3c845ccb1775cec28d913bfde5df6260
SHA1 585ced72c344b06ddcb296ac71257452831d24c4
SHA512 6d638c0d88a6647df56279d707471b28e950ae3e226230e234c830e1152343dd33335815f2395c25f77666fe0626cb26a3588e5cf6d246478f494a4ec82211ca
SSDEEP 6144:YWYQ/tE6JVC1NCnN9tYz1lgdZ4plrcu2d/S/LfdkVD/2tvNJYPT2Y:YWX5GplgdZ4jrpy0LfdkFutv3
TLSH
T144743C15E7DA0559E027E67E8267D237F6337AC9635062DF82B4CA6C2B03D62327DE40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9

File Explorer

7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9

.exe 346KB

7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9

IMPHASH 2130a0b4f857056e7564893b8dfe25d6
SHA256 7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9
MD5 3c845ccb1775cec28d913bfde5df6260
SHA1 585ced72c344b06ddcb296ac71257452831d24c4
SHA512 6d638c0d88a6647df56279d707471b28e950ae3e226230e234c830e1152343dd33335815f2395c25f77666fe0626cb26a3588e5cf6d246478f494a4ec82211ca
SSDEEP 6144:YWYQ/tE6JVC1NCnN9tYz1lgdZ4plrcu2d/S/LfdkVD/2tvNJYPT2Y:YWX5GplgdZ4jrpy0LfdkFutv3
TLSH
T144743C15E7DA0559E027E67E8267D237F6337AC9635062DF82B4CA6C2B03D62327DE40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpConnect WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCloseHandle

ws2_32

getaddrinfo freeaddrinfo gethostname inet_ntop

advapi32

OpenThreadToken OpenServiceW CreateServiceW ChangeServiceConfig2W RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW StartServiceA QueryServiceStatusEx QueryServiceConfigA OpenServiceA OpenSCManagerW OpenSCManagerA EnumServicesStatusExW DeleteService CreateServiceA ControlService CloseServiceHandle RegDeleteValueA RegDeleteKeyA RegSaveKeyA LookupPrivilegeValueA AdjustTokenPrivileges ConvertSidToStringSidA CreateProcessWithLogonW RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA CreateProcessAsUserA AllocateAndInitializeSid CheckTokenMembership FreeSid ImpersonateLoggedOnUser RevertToSelf ImpersonateNamedPipeClient LookupAccountSidA RegCreateKeyExA RegSetValueExA RegDeleteTreeA OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameA DuplicateTokenEx LogonUserA

dbghelp

MiniDumpWriteDump

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysFreeString SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement SafeArrayCreateVector SysAllocString VariantInit VariantClear

shell32

SHGetFolderPathW SHGetFolderPathA

bcrypt

BCryptGenRandom BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider

mscoree

CLRCreateInstance

kernel32

FlushInstructionCache Module32First Module32Next DeleteFileW CopyFileW SetStdHandle GetStdHandle GetTempPathA Process32Next Process32First LocalFree GetComputerNameA GetCurrentProcessId GetCurrentDirectoryA SetCurrentDirectoryA UpdateProcThreadAttribute DeleteProcThreadAttributeList InitializeProcThreadAttributeList ReadProcessMemory Thread32Next Thread32First SetThreadContext GetThreadContext SuspendThread OpenThread TerminateProcess CreateNamedPipeA GetCurrentThread CreateEventA DisconnectNamedPipe ConnectNamedPipe WideCharToMultiByte GlobalLock GlobalUnlock GetLocalTime CreateThread VirtualFreeEx WriteProcessMemory VirtualProtectEx VirtualAllocEx HeapAlloc HeapFree GetProcessHeap ExitProcess GetEnvironmentStrings FreeEnvironmentStringsA GetEnvironmentVariableA SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile WriteFile CloseHandle SetHandleInformation GetLastError CreatePipe HeapReAlloc InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetExitCodeProcess ResumeThread GetModuleFileNameA CopyFileA MoveFileExA MultiByteToWideChar GetProcAddress LoadLibraryA CreateEventW VirtualProtect IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW DuplicateHandle QueueUserAPC CreateRemoteThread CreateProcessA OpenProcess VirtualAlloc VirtualFree

user32

UnhookWindowsHookEx CallNextHookEx GetSystemMetrics GetDC ReleaseDC OpenClipboard CloseClipboard GetClipboardData TranslateMessage GetKeyState SetWindowsHookExA GetWindowTextA GetForegroundWindow MapVirtualKeyA ToUnicode GetKeyboardState GetAsyncKeyState DispatchMessageA PeekMessageA

gdi32

GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

Name

.text

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7091809fc5783b4344e1dea5f8d7564579de10cc8ac9defc4dd322460d03fac9

winhttp

ws2_32

advapi32

dbghelp

ole32

oleaut32

shell32

bcrypt

mscoree

kernel32

user32

gdi32

generic