cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25

Sharing

Copy URL Twitter E-mail

General

Target
cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25
Size 3.7MB
Sample260804-y59kmaxwct
SHA256 cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25
MD5 f368c7a0a929bb918b7347f4fdff96fc
SHA1 45ccca9ef803a9b3feab6a54504b5775efb8c30d
SHA512 42214a4b6af417e0cade0b4dd92961baa2d84784a54ece3c200e7e363706fe505025af294ee4e1dd34f524d5ea4a1424605f80bbf4c5867ba0b4774c35e8d86e
SSDEEP 98304:WCrPAEqG/Og3fI+skr7vFKgDWcz8raf2CVIUcoyRhn3:JrPAExGgTskrUgDRzwauCT+Rhn
TLSH
T1BA060222728EBCB1D4751170637B8BEA876DEE700B52E5CF53C40AA5897C4C27E31BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25

File Explorer

cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25

.exe 3.7MB

cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25

IMPHASH 6fde48fd7e496b2a8df45fae5df214ef
SHA256 cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25
MD5 f368c7a0a929bb918b7347f4fdff96fc
SHA1 45ccca9ef803a9b3feab6a54504b5775efb8c30d
SHA512 42214a4b6af417e0cade0b4dd92961baa2d84784a54ece3c200e7e363706fe505025af294ee4e1dd34f524d5ea4a1424605f80bbf4c5867ba0b4774c35e8d86e
SSDEEP 98304:WCrPAEqG/Og3fI+skr7vFKgDWcz8raf2CVIUcoyRhn3:JrPAExGgTskrUgDRzwauCT+Rhn
TLSH
T1BA060222728EBCB1D4751170637B8BEA876DEE700B52E5CF53C40AA5897C4C27E31BA5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

289602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\xd_gitlab\popplugin\PopPlugin\Output\bin\Release\Win32\Setup.pdb

kernel32

LoadLibraryExW lstrcmpiW FreeLibrary GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc LoadResource FindResourceExW RaiseException HeapReAlloc LockResource GetLastError MultiByteToWideChar HeapSize GetCurrentThreadId InitializeCriticalSectionEx LeaveCriticalSection LCMapStringEx FindResourceW IsDebuggerPresent OutputDebugStringW CloseHandle OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW TerminateProcess GetCurrentProcess WaitForSingleObject lstrlenW SetLastError lstrcmpA CreateProcessW GetExitCodeProcess GetSystemTimeAsFileTime WideCharToMultiByte GetModuleFileNameW SetFilePointer CreateFileW GetFileSizeEx FindFirstFileW DeleteFileW FindNextFileW FindClose RemoveDirectoryW MoveFileExW SetFileAttributesW GetTickCount DeviceIoControl ReadFile GetVersionExW GetSystemInfo LocalFree GetPrivateProfileStringW GetVersion CreatePipe GetStartupInfoW Sleep VerSetConditionMask VerifyVersionInfoW InitializeCriticalSection lstrlenA GetThreadLocale SetThreadLocale GetFileSize WriteFile MoveFileW CreateDirectoryW CopyFileW K32GetModuleFileNameExW WritePrivateProfileStringW LocalAlloc GetPrivateProfileIntW FreeResource ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlUnwind EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceFrequency GetModuleHandleExW ExitProcess GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW EnterCriticalSection HeapFree SetEndOfFile SizeofResource CreateFileA

user32

wsprintfW CharNextW MessageBoxW DestroyWindow SetTimer PostMessageW DefWindowProcW GetWindowLongW ShowWindow SetWindowLongW CreateWindowExW RegisterClassExW KillTimer IsWindow

advapi32

RegCreateKeyExW OpenSCManagerW AllocateAndInitializeSid CheckTokenMembership FreeSid RegQueryValueExW GetUserNameW DeleteService RegDeleteValueW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegDeleteKeyW RegQueryInfoKeyW RegCloseKey CloseServiceHandle ControlService StartServiceW ChangeServiceConfigW QueryServiceConfigW QueryServiceStatus OpenServiceW RegEnumKeyW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitialize CoInitializeSecurity OleRun CoTaskMemAlloc CoUninitialize

oleaut32

SysAllocString VariantInit VarUI4FromStr VariantClear SysStringLen LoadTypeLi SysFreeString LoadRegTypeLi VariantCopy GetErrorInfo

shlwapi

SHGetValueW SHDeleteValueW PathIsRootW PathSearchAndQualifyW PathFileExistsW PathAppendW PathRemoveBackslashW PathRemoveFileSpecW StrCmpIW PathRemoveExtensionW PathCombineW PathFindFileNameW PathIsDirectoryW

wininet

InternetSetOptionW HttpOpenRequestW HttpQueryInfoW InternetConnectW InternetCrackUrlW InternetOpenW InternetCloseHandle HttpSendRequestW

netapi32

Netbios

secur32

GetUserNameExW

iphlpapi

GetAdaptersInfo GetIpAddrTable

shell32

ord165 SHGetSpecialFolderPathW SHCreateDirectoryExW SHChangeNotify SHGetMalloc SHGetSpecialFolderLocation SHGetPathFromIDListW ShellExecuteW ShellExecuteExW

Name

.text

Size

481KB

Virtual Size

481KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

97KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cff3ace9a2f5c42d61b4c68dc8cd92d59144bed82a6c72f7e12c868fe853fb25

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

wininet

netapi32

secur32

iphlpapi

shell32

generic