7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107

Sharing

Copy URL Twitter E-mail

General

Target
7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107
Size 1.1MB
Sample260805-ae1yssaf65
SHA256 7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107
MD5 d5a2b6343a4dd29122452efa6f213dab
SHA1 a8029c27d77b091a42fd354f74173a0faec9719e
SHA512 155667c36c9e1c74fea323bc511513e339d380e0ec93844cfa425f4c716fcf789cabd9f51c882365923240fa7a0b8e0da0aff9d271ca4e63e607db77139679cc
SSDEEP 12288:IePZfycgJohYZqhZlIrTePZfycgJohYZqhZlIrTePZfycgJohYZqhZlIr:IIVyrTIVyrTIVyr
TLSH
T1D2455C15E6A5946CE07E82755977A722F6B97C409334EADF324D421E2FB8FC0E934B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107

File Explorer

7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107

.dll 1.1MB

7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107

IMPHASH 42151d1f575b091813727991538aaf5b
SHA256 7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107
MD5 d5a2b6343a4dd29122452efa6f213dab
SHA1 a8029c27d77b091a42fd354f74173a0faec9719e
SHA512 155667c36c9e1c74fea323bc511513e339d380e0ec93844cfa425f4c716fcf789cabd9f51c882365923240fa7a0b8e0da0aff9d271ca4e63e607db77139679cc
SSDEEP 12288:IePZfycgJohYZqhZlIrTePZfycgJohYZqhZlIrTePZfycgJohYZqhZlIr:IIVyrTIVyrTIVyr
TLSH
T1D2455C15E6A5946CE07E82755977A722F6B97C409334EADF324D421E2FB8FC0E934B20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

162928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ole32

CLIPFORMAT_UserFree CLIPFORMAT_UserMarshal CLIPFORMAT_UserSize CLIPFORMAT_UserUnmarshal CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoMarshalInterface CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUnmarshalInterface CreateBindCtx CreateGenericComposite CreateStreamOnHGlobal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal MkParseDisplayName ReleaseStgMedium STGMEDIUM_UserFree STGMEDIUM_UserMarshal STGMEDIUM_UserSize STGMEDIUM_UserUnmarshal StringFromCLSID

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysFreeString SysStringLen

shell32

ShellExecuteExW

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrClientCall2 NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree

shlwapi

DelayLoadFailureHook ord2 PathCreateFromUrlW PathFindExtensionW StrCmpNIW UrlCanonicalizeW UrlCombineW UrlCompareW UrlGetPartW UrlUnescapeW

wininet

CommitUrlCacheEntryW CreateUrlCacheEntryW FtpGetFileSize HttpEndRequestW HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetCloseHandle InternetConnectW InternetErrorDlg InternetLockRequestFile InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetReadFile InternetSetOptionW InternetSetStatusCallbackW InternetUnlockRequestFile InternetWriteFile

user32

CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetDlgItem GetPropW KillTimer LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassExW RegisterClipboardFormatW SendDlgItemMessageW SetDlgItemTextW SetPropW SetTimer TranslateMessage UnregisterClassW wsprintfW

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

iertutil

CreateUri PrivateCoInternetCombineIUri PrivateCoInternetParseIUri wine_get_canonicalized_uri

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _recalloc _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv iswalpha malloc memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen wcschr wcscmp wcscpy wcscspn wcslen wcsrchr wcstol

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW FreeLibrary GetDriveTypeW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileTime GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource MultiByteToWideChar RaiseException ReadFile RemoveDirectoryW ResolveDelayLoadedAPI SetFilePointerEx SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue WideCharToMultiByte __chkstk lstrcmpW lstrcmpiW

ntdll

_vsnprintf

AsyncGetClassBits AsyncInstallDistributionUnit BindAsyncMoniker CDLGetLongPathNameA CDLGetLongPathNameW CoGetClassObjectFromURL CoInstall CoInternetCombineIUri CoInternetCombineUrl CoInternetCombineUrlEx CoInternetCompareUrl CoInternetCreateSecurityManager CoInternetCreateZoneManager CoInternetGetProtocolFlags CoInternetGetSecurityUrl CoInternetGetSecurityUrlEx CoInternetGetSession CoInternetIsFeatureEnabled CoInternetIsFeatureEnabledForUrl CoInternetIsFeatureZoneElevationEnabled CoInternetParseIUri CoInternetParseUrl CoInternetQueryInfo CoInternetSetFeatureEnabled CompareSecurityIds CopyBindInfo CopyStgMedium CreateAsyncBindCtx CreateAsyncBindCtxEx CreateFormatEnumerator CreateIUriBuilder CreateURLMoniker CreateURLMonikerEx CreateURLMonikerEx2 CreateUri CreateUriWithFragment DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllRegisterServerEx DllUnregisterServer Extract FaultInIEFeature FindMediaType FindMediaTypeClass FindMimeFromData GetClassFileOrMime GetClassURL GetComponentIDFromCLSSPEC GetIUriPriv GetMarkOfTheWeb GetSoftwareUpdateInfo HlinkGoBack HlinkGoForward HlinkNavigateMoniker HlinkNavigateString HlinkSimpleNavigateToMoniker HlinkSimpleNavigateToString IEInstallScope IsAsyncMoniker IsLoggingEnabledA IsLoggingEnabledW IsValidURL MkParseDisplayNameEx ObtainUserAgentString PrivateCoInstall RegisterBindStatusCallback RegisterFormatEnumerator RegisterMediaTypeClass RegisterMediaTypes ReleaseBindInfo RevokeBindStatusCallback RevokeFormatEnumerator SetSoftwareUpdateAdvertisementState ShouldShowIntranetWarningSecband URLDownloadA URLDownloadToCacheFileA URLDownloadToCacheFileW URLDownloadToFileA URLDownloadToFileW URLDownloadW URLOpenBlockingStreamA URLOpenBlockingStreamW URLOpenPullStreamA URLOpenPullStreamW URLOpenStreamA URLOpenStreamW UrlMkBuildVersion UrlMkGetSessionOption UrlMkSetSessionOption WriteHitLogging ZonesReInit

Name

.text

Size

160KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7cf863f9fd8f805a68d1f120d21d42887e431a2f432cf712fe101cb9fc3f8107

ole32

oleaut32

shell32

rpcrt4

shlwapi

wininet

user32

advapi32

iertutil

ucrtbase

kernel32

ntdll

generic