71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e

Sharing

Copy URL Twitter E-mail

General

Target
71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e
Size 424KB
Sample260806-3cl13sshla
SHA256 71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e
MD5 c804a228461d1570a7c09cf36a123913
SHA1 b7c951e54620610d4f90ecfbb2567d4dd0acf505
SHA512 78c66f67a2ea54af599af735ab0602816bd56726a1c7c3d46ca57529df02f4957bc060e439e03c3b9bf1f53da318a59af1a81c2aa390106ed95f9eef06d158e1
SSDEEP 12288:M0A51XFfafJW3YxKL3LQw+l48ZI6hEen0Bw:8Dkhr
TLSH
T18F943908FA41DEF3C83E05F1444BB95A6720DF01EB111F23BB2D8DB9AFB66A05E55285
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e

File Explorer

71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e

.dll 424KB

71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e

IMPHASH 68c088d4a17c7508c6de6f4249b7b0a9
SHA256 71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e
MD5 c804a228461d1570a7c09cf36a123913
SHA1 b7c951e54620610d4f90ecfbb2567d4dd0acf505
SHA512 78c66f67a2ea54af599af735ab0602816bd56726a1c7c3d46ca57529df02f4957bc060e439e03c3b9bf1f53da318a59af1a81c2aa390106ed95f9eef06d158e1
SSDEEP 12288:M0A51XFfafJW3YxKL3LQw+l48ZI6hEen0Bw:8Dkhr
TLSH
T18F943908FA41DEF3C83E05F1444BB95A6720DF01EB111F23BB2D8DB9AFB66A05E55285
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

74612

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlRaiseException vDbgPrintExWithPrefix

advapi32

RegCloseKey RegCreateKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx

kernel32

CloseHandle CreateMutexW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW ExitProcess FindResourceW FlushInstructionCache FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReleaseMutex SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte lstrcmpW lstrcmpiA lstrcmpiW lstrcpyW lstrcpynA lstrcpynW lstrlenW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _memicmp _onexit _unlock _vsnprintf _vsnwprintf abort bsearch calloc free fwrite iswspace memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp strrchr vfprintf vsprintf wcscat wcschr wcscpy wcslen wcstol wcstoul

shlwapi

ord172 ord509 ord176 ord174 PathAddExtensionW PathAppendW PathFindExtensionW PathIsDirectoryW PathIsRootW PathIsURLW ord456 ord120 ord278 SHDeleteKeyW SHDeleteValueW ord545 SHGetValueW ord204 SHRegDuplicateHKey SHRegGetUSValueA SHSetValueW SHStrDupW ord217 StrCmpIW StrCmpW StrRetToBufW StrRetToStrW UrlApplySchemeW UrlCanonicalizeW

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1004B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

214KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

71d5fa8e07aa6edc6f3081474f840f228ac826cae6ea4bb55ae44390bcc0762e

ntdll

advapi32

comctl32

kernel32

msvcrt

shlwapi

generic