143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784

Sharing

Copy URL Twitter E-mail

General

Target
143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784
Size 5.3MB
Sample260806-e413bafg32
SHA256 143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784
MD5 4be7d4f7a033cd749ba3e7d43318c41a
SHA1 a58c816eadd30644b3044bf20d391f62f61bc6b8
SHA512 52f3f99ae8bef48bacb95913c1d91f9bba022750febde052d44ec12ff701b5f90aa280084ec99bce34865eebd1e18cd5b7f0eb5224343bec42f3dcaad08db784
SSDEEP 98304:G4X33Ig3V1q+0RmW7QTtx+DHUw4w1LEkVsZq:G4H3z1qz4W7QBx+7TZVsU
TLSH
T161466D57F2DA6F51D03C2C7D888323576222B99CEB00C726A1C8D59D3EEA8B93D91DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784

File Explorer

143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784

.dll 5.3MB

143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784

IMPHASH 8c463a6b58915b7f744b989df2a61e5d
SHA256 143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784
MD5 4be7d4f7a033cd749ba3e7d43318c41a
SHA1 a58c816eadd30644b3044bf20d391f62f61bc6b8
SHA512 52f3f99ae8bef48bacb95913c1d91f9bba022750febde052d44ec12ff701b5f90aa280084ec99bce34865eebd1e18cd5b7f0eb5224343bec42f3dcaad08db784
SSDEEP 98304:G4X33Ig3V1q+0RmW7QTtx+DHUw4w1LEkVsZq:G4H3z1qz4W7QBx+7TZVsU
TLSH
T161466D57F2DA6F51D03C2C7D888323576222B99CEB00C726A1C8D59D3EEA8B93D91DD4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

935784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\MRPOL\MRPOL\example_win32_directx11\Release\MRPOL.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpOpen WinHttpConnect WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSendRequest WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpQueryDataAvailable

ole32

CoCreateInstance CoInitializeEx

ws2_32

htons closesocket socket send WSACleanup WSAStartup recv connect gethostbyname

iphlpapi

GetAdaptersInfo

kernel32

InitOnceComplete InitOnceBeginInitialize InitializeSListHead GetSystemTimeAsFileTime GetProcessHeap SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind IsProcessorFeaturePresent TerminateProcess OutputDebugStringA MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress FreeLibrary QueryPerformanceCounter DisableThreadLibraryCalls CreateThread VirtualProtect GetTickCount64 GetModuleHandleW CreateToolhelp32Snapshot CloseHandle Module32FirstW GetCurrentProcessId Module32NextW RtlLookupFunctionEntry LeaveCriticalSection InitializeCriticalSection ReadFile GetFileSizeEx GetModuleHandleExW GetModuleFileNameW CreateFileW GetCurrentProcess FlushInstructionCache SetThreadAffinityMask VirtualFree VirtualAlloc GetProcessAffinityMask SetThreadPriority WaitForSingleObject K32EmptyWorkingSet CreateEventW Sleep SetEvent GetCurrentThread GetCurrentProcessorNumber DeleteCriticalSection VirtualQuery GetModuleFileNameA GetThreadContext ExitProcess IsDebuggerPresent CheckRemoteDebuggerPresent GetLastError GetTempPathA GetLocalTime GetModuleHandleExA GetFileAttributesA LoadLibraryExA FormatMessageA HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentThreadId OpenThread SuspendThread ResumeThread SetThreadContext Thread32First Thread32Next GetSystemInfo RtlCaptureContext RaiseException SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection

user32

EmptyClipboard GetClipboardData SetClipboardData CloseClipboard CallWindowProcA GetRawInputData ClipCursor GetDesktopWindow SetWindowLongPtrA ShowCursor GetKeyNameTextA MapVirtualKeyA MessageBeep MessageBoxA GetAsyncKeyState DefWindowProcW GetKeyState GetMessageExtraInfo OpenClipboard ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetCursorPos IsWindowUnicode ReleaseCapture SetCursorPos GetClientRect

comdlg32

GetSaveFileNameA GetOpenFileNameA

shell32

ShellExecuteW

imm32

ImmSetConversionStatus ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmAssociateContextEx ImmSetOpenStatus

msvcp140

?_Random_device@std@@YAIXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

winmm

timeBeginPeriod timeEndPeriod

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp wcsrchr __intrinsic_setjmp memmove memchr __vcrt_LoadLibraryExW __vcrt_GetModuleFileNameW __std_type_info_destroy_list _CxxThrowException __C_specific_handler_noexcept __current_exception __current_exception_context memset memcpy longjmp __std_exception_copy __std_terminate strstr strchr __C_specific_handler wcsstr __std_exception_destroy strrchr

api-ms-win-crt-stdio-l1-1-0

fflush fclose tmpnam _wfopen __acrt_iob_func fgets freopen fputs fopen fwrite fputc _get_stream_buffer_pointers ftell ferror getc _ftelli64 _popen tmpfile feof ungetc _pclose _fseeki64 clearerr __stdio_common_vsscanf fgetc fseek __stdio_common_vfprintf fgetpos fsetpos setvbuf fread fopen_s __stdio_common_vsprintf

api-ms-win-crt-time-l1-1-0

strftime _difftime64 _time64 clock _mktime64 _localtime64_s _localtime64 _gmtime64

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncpy strcoll strncat_s islower strcpy_s ispunct strcat_s _stricmp tolower iscntrl isalpha isupper isgraph wcscpy_s strcmp strpbrk isspace isxdigit strncpy_s strncmp toupper isdigit strspn isalnum

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

api-ms-win-crt-convert-l1-1-0

atoi atof strtod strtoll

api-ms-win-crt-math-l1-1-0

sqrt sinf lroundf _fdclass acos acosf asin atan2 tan atan2f roundf ceil ceilf cos sqrtf cosf exp expf floor floorf frexp fmod fmodf tanf sin pow log10 log ldexp

api-ms-win-crt-runtime-l1-1-0

_initterm_e strerror _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function abort _initialize_onexit_table _errno _invoke_watson _initialize_narrow_environment exit _configure_narrow_argv _beginthreadex _seh_filter_dll terminate system

api-ms-win-crt-filesystem-l1-1-0

_unlock_file rename _lock_file remove

api-ms-win-crt-locale-l1-1-0

setlocale localeconv

api-ms-win-crt-environment-l1-1-0

getenv

Sharing

General

Malware Config

Signatures

File Explorer

143f371eae6731b82cd14655a2571bb6bdf4df6833efed1640b2a7baeaf0a784

d3d11

d3dcompiler_47

winhttp

ole32

ws2_32

iphlpapi

kernel32

user32

comdlg32

shell32

imm32

msvcp140

winmm

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic