c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580

Sharing

Copy URL Twitter E-mail

General

Target
c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580
Size 1.5MB
Sample260805-a44e8abb72
SHA256 c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580
MD5 f4cecdf586033d12575affdbb0ea7cc4
SHA1 dbc2d9b65850abcd60cef59eedc3a0c59a925d40
SHA512 1caeac3eab78611e652220374836df0494eb337af5d4c9a471f345fe074f8a83d56dfc1d76483d3461714e9bb97b15a7384e04209a0a598e0e89b3c64cbaa9e3
SSDEEP 24576:j53qbTHzeeKgmbSqAy3CUH2J+J6AVFStQDZEd03f1:V6bLzeeKxSnyyUHP6AStaJf
TLSH
T153755B36FB44C1A8D1E7D278C58A4AD6E6B67C064630D23F07A4636E2F237704D6B3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580

File Explorer

c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580

.exe 1.5MB

c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580

IMPHASH e51306db143b537028c4da5712e38a7c
SHA256 c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580
MD5 f4cecdf586033d12575affdbb0ea7cc4
SHA1 dbc2d9b65850abcd60cef59eedc3a0c59a925d40
SHA512 1caeac3eab78611e652220374836df0494eb337af5d4c9a471f345fe074f8a83d56dfc1d76483d3461714e9bb97b15a7384e04209a0a598e0e89b3c64cbaa9e3
SSDEEP 24576:j53qbTHzeeKgmbSqAy3CUH2J+J6AVFStQDZEd03f1:V6bLzeeKxSnyyUHP6AStaJf
TLSH
T153755B36FB44C1A8D1E7D278C58A4AD6E6B67C064630D23F07A4636E2F237704D6B3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

387612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\ws\image_ttac_ynnoo_malc\91563\cn-ttp-desktop\packages\builder\apollo-setup\Windows\Packet\LarkLauncher\bin\UnicodeRelease\LarkLauncher.pdb

kernel32

RtlCaptureStackBackTrace LoadLibraryExA VirtualQuery GetSystemInfo MoveFileExW MoveFileW FormatMessageW LocalFree LoadLibraryW GetProcAddress OpenProcess CreateProcessW GetExitCodeProcess GetCurrentProcess GetProcessTimes Sleep CreateEventW WaitForSingleObject SetEvent GetLastError WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleCP EnumSystemLocalesW CloseHandle FindNextFileW FindFirstFileW FindClose GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapFree ExitProcess VerSetConditionMask GetStdHandle GetEnvironmentVariableW ExpandEnvironmentStringsW GetCurrentDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetDiskFreeSpaceExW GetFileAttributesW GetFinalPathNameByHandleW GetLogicalDriveStringsW QueryDosDeviceW RemoveDirectoryW SetFileAttributesW WriteFile DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcessId TerminateProcess GetCurrentThreadId GetVersionExW GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW lstrlenW QueryFullProcessImageNameW VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte AllocConsole K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW WaitForMultipleObjects CopyFileW SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap LocalFileTimeToFileTime ReadFile SetFilePointer SetFileTime SystemTimeToFileTime GetStringTypeW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread GetNativeSystemInfo EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection EncodePointer SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter QueryPerformanceFrequency CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleHandleA LoadLibraryExW VirtualAlloc VirtualProtect VirtualFree SetProcessAffinityMask ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlPcToFileHeader RtlUnwindEx SetStdHandle GetFileType GetTimeZoneInformation ExitThread ResumeThread GetModuleHandleExW RtlUnwind

user32

GetWindowThreadProcessId wsprintfW GetSystemMetrics MessageBoxW GetShellWindow UnregisterClassW

advapi32

RegOpenKeyExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership EqualSid FreeSid GetTokenInformation RegCloseKey RegDeleteKeyExW DuplicateTokenEx RegQueryValueExW LookupPrivilegeValueW GetUserNameW

shell32

SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHCreateDirectoryExW ShellExecuteW SHChangeNotify

ws2_32

getsockopt socket WSAStartup WSAGetLastError closesocket

shlwapi

PathIsRelativeW PathIsNetworkPathW SHGetValueW SHDeleteValueW SHDeleteKeyW PathFindFileNameW PathIsDirectoryW PathFindExtensionW SHSetValueW PathFileExistsW StrStrIW

wintrust

WinVerifyTrust CryptCATAdminReleaseCatalogContext CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData CryptCATAdminAcquireContext CryptCATAdminReleaseContext CryptCATAdminEnumCatalogFromHash CryptCATCatalogInfoFromContext

crypt32

CryptDecodeObjectEx CryptStringToBinaryA CertGetNameStringW

bcrypt

BCryptImportKeyPair BCryptEncrypt BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoInitialize CoInitializeSecurity CoUninitialize

oleaut32

SysFreeString VariantInit VariantClear GetErrorInfo VariantChangeType SetErrorInfo CreateErrorInfo SysAllocString

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Sharing

General

Malware Config

Signatures

File Explorer

c7bcb6f3fdb7bfef2a8b38e658f607affa1a884c2a2b2aa689c032f0417be580

kernel32

user32

advapi32

shell32

ws2_32

shlwapi

wintrust

crypt32

bcrypt

ole32

oleaut32

generic