f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c

Sharing

Copy URL Twitter E-mail

General

Target
f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c
Size 640KB
Sample260806-27lhcssfrd
SHA256 f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c
MD5 3586450d8ba62371c2e884dfc2366a44
SHA1 e9515b2c48505cbd3de6c4c41d9be9aa7ebe3ced
SHA512 8e48fe5ded15361443f7ef385fb938ace1827a754cab5f023d3e314bff906db4053f660b6405a36ba03e28293318ca0dbadadf780a3b01d9678a72eb4a95eb3a
SSDEEP 6144:R2vgPCtVGAs6w1M5wJEbIz5am9H1Vq+EzCFx6Rspur0:4oP4+S5UEyVEYcU
TLSH
T122D41B12A3FD9A56F6F37B30A97D22660E7BBDA1EA39C74D0245105D1C71B908E60B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c

File Explorer

f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c

.dll 640KB

f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c

IMPHASH 352829e9645e359f7e2cd41a2ccf37da
SHA256 f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c
MD5 3586450d8ba62371c2e884dfc2366a44
SHA1 e9515b2c48505cbd3de6c4c41d9be9aa7ebe3ced
SHA512 8e48fe5ded15361443f7ef385fb938ace1827a754cab5f023d3e314bff906db4053f660b6405a36ba03e28293318ca0dbadadf780a3b01d9678a72eb4a95eb3a
SSDEEP 6144:R2vgPCtVGAs6w1M5wJEbIz5am9H1Vq+EzCFx6Rspur0:4oP4+S5UEyVEYcU
TLSH
T122D41B12A3FD9A56F6F37B30A97D22660E7BBDA1EA39C74D0245105D1C71B908E60B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlCreateUnicodeStringFromAsciiz RtlFreeUnicodeString RtlRaiseException vDbgPrintExWithPrefix

advapi32

OpenThreadToken RegCloseKey RegEnumKeyExW RegEnumValueA RegOpenCurrentUser RegOpenKeyA RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW

kernel32

CloseHandle CreateEventW CreateThread DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExitThread ExpandEnvironmentStringsW FindResourceW FreeLibrary FreeResource GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeW GetEnvironmentVariableA GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameW GetModuleHandleA GetPrivateProfileStringW GetProcAddress GetProcessHeap GetProfileStringW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc LockResource MoveFileA MultiByteToWideChar OpenFile PulseEvent QueryPerformanceCounter QueryPerformanceFrequency ResetEvent ResumeThread RtlUnwind SearchPathW SetEvent SetLastError SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte _hwrite _lclose _llseek _lread lstrcpyW lstrcpynA lstrcpynW lstrlenW

msvcrt

__dllonexit _amsg_exit _assert _errno _initterm _iob _lock _onexit _snwprintf _stricmp _strnicmp _unlock _vsnprintf _wcsicmp _wcsnicmp abort bsearch calloc free fwrite memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp strrchr toupper vfprintf wcschr wcscmp wcsrchr wcsstr wcstoul _wcsicmp

userenv

ExpandEnvironmentStringsForUserW

user32

CharLowerW CharUpperW DispatchMessageA GetActiveWindow GetAsyncKeyState GetMessageA IsWindow KillTimer LoadStringA LoadStringW MessageBoxA MsgWaitForMultipleObjects PeekMessageA PeekMessageW PostMessageA PostMessageW PostThreadMessageA PostThreadMessageW SendMessageA SetTimer

CloseDriver DefDriverProc DriverCallback DrvClose DrvDefDriverProc DrvGetModuleHandle DrvOpen DrvOpenA DrvSendMessage GetDriverFlags GetDriverModuleHandle OpenDriver OpenDriverA PlaySound PlaySoundA PlaySoundW SendDriverMessage WINMM_3 WINMM_4 auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume gfxBatchChange gfxCreateGfxFactoriesList gfxDestroyDeviceInterfaceList gfxEnumerateGfxs gfxOpenGfx joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProc16 mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion sndPlaySoundA sndPlaySoundW timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

572B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

369KB

Virtual Size

368KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f89b575923213c842b7f2535d572593c9e56de68dac779f45ed614e23f95a95c

ntdll

advapi32

kernel32

msvcrt

userenv

user32

generic