4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a

Sharing

Copy URL Twitter E-mail

General

Target
4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a
Size 4.4MB
Sample260804-ylmlradk3w
SHA256 4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a
MD5 90bc9d5d842e0ba8f97421a9b0600ae3
SHA1 1eb8a70e2e25f50d847628819565881c8d63ec46
SHA512 29186242c4b99c9ea0cd8383de74c61dc81db6aa09781b7438196d607b028c5daa6a9b4078d5d4c81aed9fbe9f41c35c943aa4ee35a51df92d21ce53b3a69619
SSDEEP 98304:SKrglkiJQHqWrhgt0P6joeIsD9IDsvC6GgFLOAkGkzdnEVomFHKnP:S0glk5HqWrsjoeIsZIgEgFLOyomFHKnP
TLSH
T17526C0123D4D0065F06B2233DE89A6F8F16F6C60277951972AD0FE3DA531BC18A1DE5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a

File Explorer

4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a

.dll 4.4MB

4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a

IMPHASH 03e5c3a1fc8398c3f79f1eff390d1f2c
SHA256 4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a
MD5 90bc9d5d842e0ba8f97421a9b0600ae3
SHA1 1eb8a70e2e25f50d847628819565881c8d63ec46
SHA512 29186242c4b99c9ea0cd8383de74c61dc81db6aa09781b7438196d607b028c5daa6a9b4078d5d4c81aed9fbe9f41c35c943aa4ee35a51df92d21ce53b3a69619
SSDEEP 98304:SKrglkiJQHqWrhgt0P6joeIsD9IDsvC6GgFLOAkGkzdnEVomFHKnP:S0glk5HqWrsjoeIsZIgEgFLOyomFHKnP
TLSH
T17526C0123D4D0065F06B2233DE89A6F8F16F6C60277951972AD0FE3DA531BC18A1DE5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1645258

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\testinject\x64\Release\libcef.pdb

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetFileType SetStdHandle HeapQueryInformation GetCommandLineW GetCommandLineA VirtualQuery VirtualAlloc GetSystemInfo ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread InterlockedFlushSList RtlUnwind GetCPInfo GetStringTypeW LCMapStringW SetFilePointerEx LCMapStringEx QueryPerformanceFrequency GetExitCodeThread WaitForSingleObjectEx TryAcquireSRWLockExclusive RaiseException OutputDebugStringW IsValidLocale EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetWindowsDirectoryW FindResourceExW SystemTimeToTzSpecificLocalTime LocalFileTimeToFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime GetProfileIntW SearchPathW GetTempPathW GetStringTypeExW MoveFileW lstrcmpiW DuplicateHandle UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetShortPathNameW FlushFileBuffers FindFirstFileW DeleteFileW VirtualProtect GlobalFlags LocalReAlloc LocalAlloc GlobalHandle TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetThreadLocale FileTimeToSystemTime GetUserDefaultLCID SystemTimeToFileTime ReplaceFileW SetFileTime GetTempFileNameW GetFullPathNameW GetFileTime GetDiskFreeSpaceW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW CompareStringA GetVersionExW lstrcmpA GetCurrentDirectoryW ResumeThread SetThreadPriority lstrcpyW GlobalReAlloc GetFileSize CopyFileW FormatMessageW MulDiv LocalFree GlobalFree GlobalSize GlobalAlloc GlobalGetAtomNameW GlobalLock GlobalUnlock GetCurrentProcessId CompareStringW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryW LoadLibraryA LoadLibraryExW GetModuleHandleW FreeLibrary GetSystemDirectoryW GetCurrentThreadId SetLastError EncodePointer OutputDebugStringA InitializeCriticalSectionAndSpinCount VerifyVersionInfoW VerSetConditionMask WTSGetActiveConsoleSessionId IsWow64Process GetProcAddress CloseThreadpoolIo GetModuleHandleA CreateFileW CreateThreadpoolIo WriteFile CreateProcessW WaitForSingleObject CreateMutexA GetNativeSystemInfo FindClose FindNextFileA HeapFree FindFirstFileA WideCharToMultiByte Process32FirstW Process32NextW CreateToolhelp32Snapshot OpenProcess OpenMutexA GetModuleFileNameA GetTickCount64 Sleep DeleteFileA CreateFileA GetTempPathA CloseHandle GetCurrentThread GetFileAttributesW GetCurrentProcess GetModuleFileNameW MultiByteToWideChar FindResourceW LoadResource LockResource SizeofResource GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection

user32

SetCapture GetAsyncKeyState ReleaseDC GetDC MapVirtualKeyW GetKeyNameTextW CopyImage FillRect DrawStateW EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar RemoveMenu AppendMenuW InsertMenuW GetMenuState GetMenuStringW ReuseDDElParam UnpackDDElParam DestroyIcon GetDesktopWindow IntersectRect SetCursor InsertMenuItemW DestroyMenu CreatePopupMenu TranslateAcceleratorW LoadAcceleratorsW ReleaseCapture GetActiveWindow BringWindowToTop IsDialogMessageW SetWindowTextW IsWindowEnabled GetMenuDefaultItem SetMenuDefaultItem SetClassLongW UpdateLayeredWindow EnableScrollBar MonitorFromPoint EnableWindow CheckDlgButton SetDlgItemTextW MoveWindow ShowWindow GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetClassNameW SetWindowLongW GetWindowLongW PtInRect EqualRect DestroyAcceleratorTable MessageBoxW AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW KillTimer GetUpdateRect LockWindowUpdate GetCursorPos WindowFromPoint SetRect UnionRect DrawEdge DrawFrameControl GetSysColorBrush DrawFocusRect DrawIconEx SetLayeredWindowAttributes LoadCursorW SystemParametersInfoW EnumDisplayMonitors DrawTextW SetPropW ShowScrollBar GetScrollRange DrawTextExW GetMenuItemInfoW GrayStringW TabbedTextOutW GetWindowDC TrackMouseEvent CharUpperW SetTimer InvalidateRect UpdateWindow GetParent GetClientRect SetRectEmpty LoadBitmapW GetSysColor IsChild GetSubMenu SendMessageW ScreenToClient InflateRect GetFocus GetWindowRect LoadMenuW LoadImageW RedrawWindow GetSystemMetrics MessageBoxA ClientToScreen IsIconic GetShellWindow GetWindowThreadProcessId RegisterWindowMessageW PostMessageW IsWindow DestroyWindow IsWindowVisible IsZoomed GetCapture SetForegroundWindow SetWindowRgn CopyRect OffsetRect IsRectEmpty GetClassLongW GetTabbedTextExtentW SetParent GetTopWindow GetWindow DispatchMessageW PeekMessageW GetMessagePos GetMessageTime DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetClassInfoExW CreateWindowExW IsMenu SetWindowPos GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetDlgItem GetDlgCtrlID SetFocus GetKeyState GetMenu SetMenu GetMenuItemID GetMenuItemCount TrackPopupMenu SetActiveWindow GetForegroundWindow BeginPaint EndPaint ValidateRect ScrollWindow SetScrollPos GetScrollPos SetScrollRange CharUpperBuffW GetIconInfo ModifyMenuW PostQuitMessage GetSystemMenu DeleteMenu MessageBeep NotifyWinEvent GetMessageW TranslateMessage RegisterClipboardFormatW GetPropW ShowOwnedPopups CreateDialogIndirectParamW EndDialog GetNextDlgTabItem SetWindowContextHelpId MapDialogRect PostThreadMessageW WaitMessage FrameRect HideCaret InvertRect SetCursorPos SendDlgItemMessageA RealChildWindowFromPoint DestroyCursor SubtractRect CopyIcon GetDoubleClickTime ToUnicodeEx GetKeyboardLayout GetKeyboardState CreateAcceleratorTableW CopyAcceleratorTableW IsClipboardFormatAvailable EnumChildWindows GetNextDlgGroupItem GetComboBoxInfo CharNextW InvalidateRgn DrawIcon CreateMenu GetWindowRgn IsCharLowerW MapVirtualKeyExW MapWindowPoints

gdi32

ExtTextOutW CreatePolygonRgn Polyline CreateDIBitmap CreatePen CreatePatternBrush EnumFontFamiliesW GetTextCharsetInfo GetTextMetricsW Escape ExcludeClipRect GetClipBox GetCurrentPositionEx GetObjectType GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetStretchBltMode SetTextAlign StartDocW GetTextColor TextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRoundRectRgn GetMapMode SetRectRgn DPtoLP RoundRect Rectangle EndDoc StartPage EndPage AbortDoc SetAbortProc GetCharWidthW GetRgnBox OffsetRgn CreatePalette GetPaletteEntries ExtFloodFill SetPaletteEntries GetViewportOrgEx LPtoDP GetWindowOrgEx EnumFontFamiliesExW FillRgn FrameRgn GetBoundsRect PtInRegion GetNearestPaletteIndex GetSystemPaletteEntries GetROP2 GetBkMode GetNearestColor GetPolyFillMode GetStretchBltMode GetTextAlign GetTextFaceW SetPixelV GetBkColor Ellipse CreateSolidBrush CreateHatchBrush CreateEllipticRgn CreateRectRgnIndirect SetDIBColorTable StretchBlt SetPixel SelectPalette RealizePalette PatBlt GetPixel GetDIBits CreateRectRgn CombineRgn BitBlt CreateBitmap GetDeviceCaps CreateDCW CopyMetaFileW CreateCompatibleBitmap SetTextColor SetBkColor DeleteDC GetObjectW GetTextExtentPoint32W CreateFontIndirectW DeleteObject GetStockObject CreateCompatibleDC SelectObject MoveToEx Polygon CreateDIBSection

msimg32

AlphaBlend TransparentBlt

winspool.drv

GetJobW OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegSetValueExW OpenProcessToken RegEnumValueW RegEnumKeyExW SetFileSecurityW GetFileSecurityW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegSetValueW LookupPrivilegeValueW RegCloseKey RegOpenKeyExW IsWellKnownSid GetTokenInformation CloseServiceHandle OpenSCManagerA ChangeServiceConfigA StartServiceA QueryServiceConfigW QueryServiceStatusEx OpenServiceA AdjustTokenPrivileges

shell32

DragQueryFileW DragFinish SHAppBarMessage SHGetFileInfoW ShellExecuteW SHGetMalloc ExtractIconW SHAddToRecentDocs SHGetDesktopFolder SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetFolderPathW

comctl32

InitCommonControlsEx ImageList_AddMasked

shlwapi

PathIsUNCW PathStripToRootW PathRemoveFileSpecW StrFormatKBSizeW PathFindExtensionW PathFindFileNameW

uxtheme

GetThemeSysColor OpenThemeData CloseThemeData DrawThemeText GetThemePartSize DrawThemeBackground GetThemeColor GetCurrentThemeName DrawThemeParentBackground IsAppThemed GetWindowTheme IsThemeBackgroundPartiallyTransparent

ole32

CoRegisterMessageFilter CoLockObjectExternal StgCreateDocfileOnILockBytes CoGetClassObject OleLockRunning OleGetClipboard DoDragDrop OleIsCurrentClipboard OleFlushClipboard CoDisconnectObject CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes OleUninitialize OleInitialize CoFreeUnusedLibraries CLSIDFromProgID CLSIDFromString CoInitialize CoCreateGuid CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc StringFromCLSID CoInitializeEx CoCreateInstance CoUninitialize OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator RegisterDragDrop RevokeDragDrop CoRevokeClassObject

oleaut32

VariantCopy SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VariantChangeType SysAllocStringLen VariantInit SysFreeString SysAllocString VariantClear OleCreateFontIndirect VarBstrFromDate LoadTypeLi

oledlg

OleUIBusyW

gdiplus

GdipDisposeImage GdipCloneImage GdipCreateFromHDC GdiplusStartup GdipFree GdipAlloc GdiplusShutdown GdipDrawImageI GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipCreateBitmapFromHBITMAP GdipDeleteGraphics GdipSetInterpolationMode GdipDrawImageRectI GdipGetImagePixelFormat GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight

rpcrt4

RpcStringBindingComposeW RpcStringFreeW RpcBindingSetAuthInfoExA NdrClientCall2 NdrServerCall2 RpcBindingFromStringBindingW

wtsapi32

WTSFreeMemory WTSEnumerateProcessesW

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

cef_add_cross_origin_whitelist_entry cef_add_web_plugin_directory cef_add_web_plugin_path cef_api_hash cef_base64decode cef_base64encode cef_begin_tracing cef_binary_value_create cef_browser_host_create_browser cef_browser_host_create_browser_sync cef_clear_cross_origin_whitelist cef_clear_scheme_handler_factories cef_command_line_create cef_command_line_get_global cef_cookie_manager_create_manager cef_cookie_manager_get_global_manager cef_create_url cef_currently_on cef_dictionary_value_create cef_do_message_loop_work cef_drag_data_create cef_enable_highdpi_support cef_end_tracing cef_execute_process cef_force_web_plugin_shutdown cef_format_url_for_security_display cef_get_current_platform_thread_id cef_get_extensions_for_mime_type cef_get_geolocation cef_get_mime_type cef_get_path cef_initialize cef_is_web_plugin_unstable cef_launch_process cef_list_value_create cef_log cef_now_from_system_trace_time cef_parse_csscolor cef_parse_json cef_parse_jsonand_return_error cef_parse_url cef_post_data_create cef_post_data_element_create cef_post_delayed_task cef_post_task cef_print_settings_create cef_process_message_create cef_quit_message_loop cef_refresh_web_plugins cef_register_extension cef_register_scheme_handler_factory cef_register_web_plugin_crash cef_remove_cross_origin_whitelist_entry cef_remove_web_plugin_path cef_request_context_create_context cef_request_context_get_global_context cef_request_create cef_response_create cef_run_message_loop cef_set_osmodal_loop cef_shutdown cef_stream_reader_create_for_data cef_stream_reader_create_for_file cef_stream_reader_create_for_handler cef_stream_writer_create_for_file cef_stream_writer_create_for_handler cef_string_list_alloc cef_string_list_append cef_string_list_copy cef_string_list_free cef_string_list_size cef_string_list_value cef_string_map_alloc cef_string_map_append cef_string_map_free cef_string_map_key cef_string_map_size cef_string_map_value cef_string_multimap_alloc cef_string_multimap_append cef_string_multimap_free cef_string_multimap_key cef_string_multimap_size cef_string_multimap_value cef_string_userfree_utf16_free cef_string_utf16_clear cef_string_utf16_cmp cef_string_utf16_set cef_string_utf16_to_utf8 cef_string_utf8_clear cef_string_utf8_to_utf16 cef_string_wide_to_utf8 cef_task_runner_get_for_current_thread cef_task_runner_get_for_thread cef_time_delta cef_time_now cef_time_to_timet cef_unregister_internal_web_plugin cef_uridecode cef_uriencode cef_urlrequest_create cef_v8context_get_current_context cef_v8context_get_entered_context cef_v8context_in_context cef_v8stack_trace_get_current cef_v8value_create_array cef_v8value_create_bool cef_v8value_create_date cef_v8value_create_double cef_v8value_create_function cef_v8value_create_int cef_v8value_create_null cef_v8value_create_object cef_v8value_create_string cef_v8value_create_uint cef_v8value_create_undefined cef_value_create cef_visit_web_plugin_info cef_write_json cef_zip_reader_create create_context_shared

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

543KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

518KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4631de935709682a57d9db8607e1c28535a9643ab5229f537cccede84327ad5a

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

rpcrt4

wtsapi32

oleacc

imm32

winmm

generic