827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949

Sharing

Copy URL Twitter E-mail

General

Target
827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949
Size 3.2MB
Sample260806-11hmfsvtcs
SHA256 827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949
MD5 ce0e155e5bc7bd334fd646ef812ac7ef
SHA1 66638d91fdb66ecbc3d62d7d3500207317d9fbf3
SHA512 6bde755d2c60734a68ef452a8358aea107f3f8f12a7547f1481da109575bca1ee34781de0bd7c89cc8289b7294dd3849bb082145d93479a6a4f420005c24f7f3
SSDEEP 98304:yo0FIFfjXF3cXAERE8EEEiEEE6EEEYEEE/EEEvEEEsr4jXF3cXAERE8EEEiEEE6+:fjXF3cXAERE8EEEiEEE6EEEYEEE/EEE0
TLSH
T1F3F5DD91B2101355E2FF50B56C931CEADF0026A517B913C68FC8A77A2F83E9B867E507
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949

File Explorer

827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949

.exe 3.2MB

827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949

IMPHASH f3631fa922171296fe4ca37760a75258
SHA256 827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949
MD5 ce0e155e5bc7bd334fd646ef812ac7ef
SHA1 66638d91fdb66ecbc3d62d7d3500207317d9fbf3
SHA512 6bde755d2c60734a68ef452a8358aea107f3f8f12a7547f1481da109575bca1ee34781de0bd7c89cc8289b7294dd3849bb082145d93479a6a4f420005c24f7f3
SSDEEP 98304:yo0FIFfjXF3cXAERE8EEEiEEE6EEEYEEE/EEEvEEEsr4jXF3cXAERE8EEEiEEE6+:fjXF3cXAERE8EEEiEEE6EEEYEEE/EEE0
TLSH
T1F3F5DD91B2101355E2FF50B56C931CEADF0026A517B913C68FC8A77A2F83E9B867E507
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

l:\WorkCode\ShareCode\trunk\360Thrust\x64\Release\360Thrust64.pdb

kernel32

FindResourceExW EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetModuleFileNameW lstrlenW InitializeCriticalSection FreeLibrary LoadLibraryExW lstrcmpiW LocalFree LocalAlloc GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetTimeFormatA GetDateFormatA GetConsoleMode FlushInstructionCache SetFilePointer WideCharToMultiByte GetLocaleInfoA GetLocaleInfoW InitializeCriticalSectionAndSpinCount LoadLibraryA SetConsoleCtrlHandler IsValidCodePage GetOEMCP GetACP DeleteCriticalSection GetCurrentThreadId lstrlenA MultiByteToWideChar SetLastError CreateThread RaiseException CreatePipe GetStartupInfoW WaitForSingleObject ReadFile RemoveDirectoryW DeleteFileW GetVersionExW FindFirstFileW GetFileAttributesW FindNextFileW FindClose GetSystemDirectoryA DeleteFileA FindResourceW GetLastError LoadResource LockResource CloseHandle SetEnvironmentVariableA CompareStringW CompareStringA GetCPInfo FlushFileBuffers CreateFileA GetTimeZoneInformation FatalAppExitA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW SizeofResource SetFileAttributesW CreateFileW WriteFile GetModuleHandleA GetProcAddress GetCurrentProcess GetSystemDirectoryW CreateProcessW GetConsoleCP InterlockedPushEntrySList HeapFree HeapAlloc GetProcessHeap VirtualFree VirtualAlloc InterlockedPopEntrySList HeapDestroy HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader EncodePointer DecodePointer TlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentThread FlsAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA HeapSetInformation HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleW

user32

CharNextW SetWindowLongPtrW GetWindow GetWindowRect GetWindowLongW MonitorFromWindow UnregisterClassA GetClientRect MapWindowPoints SetWindowPos GetDlgItem GetParent SetDlgItemTextW SendDlgItemMessageW DestroyWindow SendMessageW EndDialog DialogBoxParamW wsprintfW GetSystemMetrics LoadImageW DefWindowProcW GetActiveWindow GetMonitorInfoW

advapi32

RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyW RegQueryValueExW RegEnumKeyW GetUserNameW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetExplicitEntriesFromAclW DeleteAce LookupAccountNameW LookupAccountSidW RegCreateKeyExW RegCreateKeyW RegSetValueExW RegDeleteValueW RegQueryInfoKeyW RegCloseKey

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW StrStrIW StrCmpIW

comctl32

InitCommonControlsEx

crypt32

CertEnumCertificatesInStore CertCloseStore CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertOpenStore CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

827c6b7c7a3a323dca58d77082894d96d5c1ee5cdec435d7574fc5f040564949

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

crypt32

generic