b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d

Sharing

Copy URL Twitter E-mail

General

Target
b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d
Size 280KB
Sample260806-3dk56scl4v
SHA256 b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d
MD5 c87065760534ec15069c96f627d654c2
SHA1 d461a166ef4458c168b21de759039d0b0931a535
SHA512 2dbcc470d96a270b49799edb9185c73f0f6cd41636b244835d1b66ba2d899ac8d88b44cb7f1d1befa2ef80eff0d157b379bb0144920cf91221a5da5e318d181f
SSDEEP 3072:IJIpWpU/JrSR1MOZJkE143i3XS7RUdDrAcaKl3FSvnGsU:IJIpW6/JrS0lUd3AcaKl3FS+s
TLSH
T148541911B2D55DCAE6BB5BB39CF259590929FF00DF208B1FA364140F9873AD3AE18712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d

File Explorer

b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d

.dll 280KB

b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d

IMPHASH 52743bc4ef36d2a359eb123f7ed8a0b5
SHA256 b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d
MD5 c87065760534ec15069c96f627d654c2
SHA1 d461a166ef4458c168b21de759039d0b0931a535
SHA512 2dbcc470d96a270b49799edb9185c73f0f6cd41636b244835d1b66ba2d899ac8d88b44cb7f1d1befa2ef80eff0d157b379bb0144920cf91221a5da5e318d181f
SSDEEP 3072:IJIpWpU/JrSR1MOZJkE143i3XS7RUdDrAcaKl3FSvnGsU:IJIpW6/JrS0lUd3AcaKl3FS+s
TLSH
T148541911B2D55DCAE6BB5BB39CF259590929FF00DF208B1FA364140F9873AD3AE18712
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlRaiseException vDbgPrintExWithPrefix

kernel32

CloseHandle CreateFileMappingW DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection EnumResourceNamesW FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFree GlobalGetAtomNameW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MapViewOfFile MultiByteToWideChar OpenProcess QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock _vsnprintf abort bsearch calloc free fwrite memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp swprintf vfprintf wcstoul _wcsicmp

ole32

CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CreateStreamOnHGlobal HMENU_UserFree HMENU_UserMarshal HMENU_UserSize HMENU_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VariantClear VariantInit

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction

user32

ChildWindowFromPointEx GetClientRect GetFocus GetWindow GetWindowLongW GetWindowThreadProcessId IsWindow IsWindowVisible LoadStringA LoadStringW MapWindowPoints RealGetWindowClassW ScreenToClient SendMessageW

Name

.text

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

725B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b2f8d92279826414dbec2aacff5f3706a5c42602d257c4971406eac09263813d

ntdll

kernel32

msvcrt

ole32

oleaut32

rpcrt4

user32

generic