44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892

Sharing

Copy URL Twitter E-mail

General

Target
44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892
Size 1.4MB
Sample260805-rybaxsak2v
SHA256 44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892
MD5 9511459ef32485eb7a90c50c050cd5db
SHA1 efe9f80a26fe7a1883aed710a1ac31dc4164f0f4
SHA512 62c5fcee993c0e81871becdc6f68c37f6d9e85b1cf4380205739472d74aa6c467aace477843e665f4b7bb50696ea3233e6b8f8f55bc7e16338a6607d3ecf2920
SSDEEP 24576:1u4Pb67j0jNDxxaEXwpuGRbyHSVWoQ4exqUBFmd6Keq:1b67jSNDxsdby4WoQBxqUBFmd1
TLSH
T13C656C117601C73AECAA01F28F7C4EDF642C6EB0079444DBA2C8596A5DB6DD36B37A13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892

File Explorer

44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892

.dll 1.4MB

44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892

IMPHASH 819573cff41b4b6bb360f9334513ca68
SHA256 44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892
MD5 9511459ef32485eb7a90c50c050cd5db
SHA1 efe9f80a26fe7a1883aed710a1ac31dc4164f0f4
SHA512 62c5fcee993c0e81871becdc6f68c37f6d9e85b1cf4380205739472d74aa6c467aace477843e665f4b7bb50696ea3233e6b8f8f55bc7e16338a6607d3ecf2920
SSDEEP 24576:1u4Pb67j0jNDxxaEXwpuGRbyHSVWoQ4exqUBFmd6Keq:1b67jSNDxsdby4WoQBxqUBFmd1
TLSH
T13C656C117601C73AECAA01F28F7C4EDF642C6EB0079444DBA2C8596A5DB6DD36B37A13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

761214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\src\_LdsCode\general_use\mg_faiconshelper\Release\BwSystemHelper.pdb

kernel32

K32GetProcessImageFileNameW lstrcpyW lstrcmpiW QueryDosDeviceW GetLogicalDriveStringsW GetTickCount CreateThread Sleep CreateMutexW ReleaseMutex WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent WideCharToMultiByte WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW OpenProcess LoadLibraryW FreeLibrary GetProcAddress GetModuleHandleW GetModuleFileNameW GetStartupInfoW GetCurrentProcess CloseHandle MultiByteToWideChar FindResourceW SizeofResource LockResource LoadResource FindResourceExW GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetModuleHandleExW ExitThread RtlUnwind GetFileSizeEx lstrcmpA DeviceIoControl GetSystemWindowsDirectoryW FindClose LocalFree CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList ReleaseSemaphore DuplicateHandle VirtualProtect GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes GetCurrentThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError CreateTimerQueueTimer GetLogicalProcessorInformation RaiseException DecodePointer GetThreadPriority SetThreadPriority SignalObjectAndWait EncodePointer GetStringTypeW FormatMessageW TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime QueryPerformanceCounter GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetCurrentProcessId GetACP CreateFileW ExitProcess FreeResource ReadFile DeleteFileW FindNextFileW SetEndOfFile WriteFile ResetEvent lstrcpynW lstrlenW FlushFileBuffers WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess

user32

GetWindowLongW SetWindowLongW LoadCursorW PostMessageW GetWindowThreadProcessId RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW PostQuitMessage IsWindowVisible GetWindowTextW PeekMessageW PostThreadMessageW wsprintfW KillTimer SetTimer DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW CallWindowProcW DefWindowProcW

advapi32

RegCloseKey RegSetValueExW OpenProcessToken GetTokenInformation RegCreateKeyExW RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteW SHCreateDirectoryExW

ole32

CoInitializeSecurity CoInitializeEx CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CoCreateGuid

oleaut32

SysFreeString SysAllocString VariantInit VariantClear SysAllocStringLen SysStringLen

shlwapi

PathAppendW StrCmpNIW StrTrimA StrStrIA StrCmpIW PathIsRelativeW PathIsRootW PathFileExistsW PathRemoveFileSpecW SHGetValueW PathCombineW StrStrIW PathIsDirectoryW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdiplusStartup GdiplusShutdown

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

44795564e523a5cdc7c9659385255b274ab80f9274ccfc720bd4ae740a777892

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

version

gdiplus

wininet

iphlpapi

urlmon

generic