74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935

Sharing

Copy URL Twitter E-mail

General

Target
74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935
Size 11.3MB
Sample260806-e42c3sx1dv
SHA256 74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935
MD5 79d990a83d54475802f0988a40c5ed18
SHA1 ac38856444d5317bccf444869f91a4418e388842
SHA512 5b5fcaee2d6a6e201529af71a321a780cbabd8d95b9496ad329a1f8a76e7bcac2b2f302d0c71a3dda07a8623c9061dcc4bb2564db8412be831847c73c6999fbf
SSDEEP 196608:pMUTunslEZEyL5Gr8WFFR40ZX3JviGeehiZl0qqTH4QnNYHVx0NTG:pM+unslEZE7ZZn5ijajsKN4VC
TLSH
T1B9C69D33A5114871E4EB117D9FEDEA79CC6CD520632804CB0AE0645A653DEE32A3D7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935

File Explorer

74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935

.dll 11.3MB

74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935

IMPHASH ad7f4bdd904dcf331447fb716818d40a
SHA256 74cc6f1d28437e958dd7deeaa584255120090c6a40bcc7642f415e2ff2b1d935
MD5 79d990a83d54475802f0988a40c5ed18
SHA1 ac38856444d5317bccf444869f91a4418e388842
SHA512 5b5fcaee2d6a6e201529af71a321a780cbabd8d95b9496ad329a1f8a76e7bcac2b2f302d0c71a3dda07a8623c9061dcc4bb2564db8412be831847c73c6999fbf
SSDEEP 196608:pMUTunslEZEyL5Gr8WFFR40ZX3JviGeehiZl0qqTH4QnNYHVx0NTG:pM+unslEZE7ZZn5ijajsKN4VC
TLSH
T1B9C69D33A5114871E4EB117D9FEDEA79CC6CD520632804CB0AE0645A653DEE32A3D7EE
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8343424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\r\ws\St_Make\code\build\win\results\activex\Release\Win32\Flash.pdb

dwmapi

DwmRenderGesture

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsIsStringEmpty WindowsCreateString WindowsGetStringRawBuffer WindowsCreateStringReference WindowsDeleteString

version

GetFileVersionInfoA VerQueryValueA VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW GetFileVersionInfoSizeA

winmm

waveOutGetNumDevs waveOutGetDevCapsW waveOutRestart waveOutReset waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutClose waveOutOpen timeEndPeriod timeBeginPeriod timeGetDevCaps timeGetTime timeKillEvent timeSetEvent waveInReset waveInStop waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInGetDevCapsW waveInGetNumDevs mixerSetControlDetails waveInGetPosition waveOutPause mixerGetControlDetailsA mixerGetLineControlsA mixerGetLineInfoA mixerClose mixerOpen mixerGetDevCapsA waveInMessage waveOutMessage waveOutGetDevCapsA mixerGetID waveInGetDevCapsA waveOutGetPosition

wininet

InternetGetCookieW InternetSetCookieW

crypt32

CertCloseStore CertVerifySubjectCertificateContext CertCreateCertificateContext CertFreeCertificateContext CryptVerifyMessageSignature CryptGetMessageCertificates CertOpenStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertFindCertificateInStore CertDuplicateCertificateContext

oleaut32

SafeArrayDestroy SafeArrayLock SafeArrayUnlock SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetVartype VariantInit VariantClear SysAllocStringLen SysFreeString SysAllocString SafeArrayCreateVector SysStringByteLen VariantChangeType VarUI4FromStr LoadTypeLi LoadRegTypeLi RegisterTypeLi UnRegisterTypeLi OleCreatePropertyFrame SysAllocStringByteLen SafeArrayPutElement SysStringLen SafeArrayGetLBound SafeArrayGetUBound VarBstrCat

dsound

ord8 ord1

msimg32

AlphaBlend

kernel32

ExpandEnvironmentStringsW GlobalAlloc GlobalFree WideCharToMultiByte GetLocaleInfoA GetModuleHandleW GetFileAttributesA SetFileAttributesA OutputDebugStringW EncodePointer DecodePointer SetLastError InitializeCriticalSectionEx CreateMutexW DisableThreadLibraryCalls GetModuleFileNameW LoadLibraryExW LoadResource SizeofResource GlobalLock GlobalUnlock LocalAlloc LocalFree MulDiv lstrcmpiW FindResourceW GetTickCount LCMapStringW GetLocaleInfoW CreateProcessA CreateDirectoryW CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx RemoveDirectoryW GetSystemTime GetSystemDirectoryW GetSystemWow64DirectoryW SystemTimeToFileTime SetThreadAffinityMask CreateFileA DeleteFileA GetFileSize GetTempFileNameW ReadFile SetFilePointer WriteFile CreateThread GetSystemDirectoryA VirtualQuery FindResourceExW LockResource FindResourceExA MoveFileExW GetUserDefaultUILanguage GetUserDefaultLangID GetUserPreferredUILanguages GetTempPathW SetUnhandledExceptionFilter GetTimeZoneInformation ReleaseSemaphore CreateSemaphoreW ExpandEnvironmentStringsA SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryA GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW GetLongPathNameW GetVolumeInformationW SetFilePointerEx OutputDebugStringA DeviceIoControl CreateMutexA GetModuleFileNameA lstrlenW GetTempPathA GetTempFileNameA ReleaseMutex MapViewOfFile UnmapViewOfFile CreateFileMappingA DuplicateHandle GetExitCodeThread SetThreadPriority TerminateThread CreateWaitableTimerW QueryPerformanceCounter QueryPerformanceFrequency SleepEx QueueUserAPC OpenThread GetModuleHandleExW K32GetProcessImageFileNameW CompareFileTime SwitchToThread GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount TlsAlloc TlsFree FormatMessageW GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetCurrentThread IsDBCSLeadByte GetCPInfo GetACP TlsSetValue MultiByteToWideChar GetProcessTimes GetCurrentThreadId GetFileAttributesW DeleteFileW GetCurrentProcess VerifyVersionInfoW VirtualProtect LoadLibraryExA CreateEventA SetWaitableTimer CancelWaitableTimer CreateWaitableTimerA VerifyVersionInfoA HeapCreate HeapDestroy HeapAlloc HeapFree HeapLock HeapUnlock HeapWalk GetProcessMitigationPolicy VirtualAlloc VirtualFree VerSetConditionMask GetSystemInfo WaitForMultipleObjects FreeLibrary GetLastError CreateEventW WaitForSingleObject ResetEvent SetEvent CloseHandle RaiseException HeapSize RaiseFailFastException GetCurrentProcessId DebugBreak LoadLibraryW LoadLibraryA GetProcAddress GetModuleHandleA TryEnterCriticalSection TlsGetValue DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection Sleep GetProcessHeap GetDateFormatW GetTimeFormatW CompareStringW GetNumberFormatW GetCurrencyFormatW GetUserDefaultLCID EnumSystemLocalesW IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent GetStringTypeW WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind InterlockedFlushSList ExitProcess SetConsoleCtrlHandler GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitThread FreeLibraryAndExitThread HeapReAlloc GetConsoleCP FlushFileBuffers SetStdHandle FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA WriteConsoleW SetEndOfFile GlobalSize GetProcessAffinityMask

user32

GetProcessWindowStation EnumDisplaySettingsW GetWindowTextLengthW DeleteMenu GetSystemMenu GetActiveWindow IsZoomed IsIconic SetWindowPlacement GetWindowPlacement MoveWindow FlashWindowEx ShowWindowAsync SetCaretPos ShowCaret DestroyCaret CreateCaret EnumDisplayDevicesW RegisterClipboardFormatW SetMenuItemInfoW GetMenuItemInfoW InsertMenuItemW RemoveMenu SetMenuInfo TrackPopupMenu DestroyMenu CreatePopupMenu CreateMenu DrawMenuBar ToAscii GetKeyboardState CharLowerW CharUpperW CloseWindow WaitForInputIdle GetMonitorInfoW CreateIconIndirect LoadImageW DestroyIcon InflateRect SetRectEmpty GetCursor SetWindowTextW SetWindowTextA GetPropW SetPropW RedrawWindow IsCharAlphaW DialogBoxIndirectParamW SendMessageTimeoutW GetClipboardFormatNameA RegisterClipboardFormatA PtInRect EqualRect IntersectRect SetWindowRgn IsWindow GetCurrentInputMessageSource SystemParametersInfoW LoadIconW GetWindowThreadProcessId WindowFromPoint MapWindowPoints ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetUserObjectInformationW MessageBoxW MessageBoxA GetWindowRect GetClientRect EndPaint BeginPaint UpdateWindow GetSubMenu EnableMenuItem CheckMenuItem KillTimer SetTimer ReleaseCapture SetCapture GetCapture GetQueueStatus MapVirtualKeyW GetPointerFrameTouchInfo GetPointerFrameInfoHistory GetPointerInfo GetKeyState GetDlgItem EndDialog DialogBoxParamW IsWindowVisible SetWindowPos RegisterClassW SendMessageW GetMessageTime PeekMessageW LoadStringW LoadStringA CopyRect PostQuitMessage SendInput GetKeyboardLayout ActivateKeyboardLayout UpdateLayeredWindow LoadCursorW GetParent UnionRect InvalidateRect ReleaseDC GetDC GetFocus SetFocus CharNextW GetClassInfoExW RegisterClassExW UnregisterClassW GetDesktopWindow GetForegroundWindow MonitorFromWindow EnumDisplayDevicesA ShowWindow DestroyWindow CreateWindowExW SetRect SetWindowLongW GetWindowLongW CallWindowProcW DefWindowProcW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW OffsetRect FillRect GetSystemMetrics GetDoubleClickTime ShowCursor GetWindow GetClassNameA EnumWindows GetWindowTextW GetWindowTextA IsWindowEnabled PostMessageW RegisterWindowMessageA PostMessageA IsChild

gdi32

EndDoc StartDocW DPtoLP ExtTextOutA SetWorldTransform GetWorldTransform GetTextMetricsW SetTextColor IntersectClipRect CreateSolidBrush GdiFlush GetObjectW CreateDIBSection SelectObject GetStockObject DeleteObject StartPage CreateCompatibleDC SetPolyFillMode StretchDIBits SetTextAlign BeginPath EndPath FillPath SelectClipPath StrokePath ExtCreatePen MoveToEx PolyBezierTo CloseMetaFile CreateMetaFileW DeleteMetaFile GetDeviceCaps TextOutW EndPage DeleteDC SetWindowExtEx SetWindowOrgEx BitBlt CreateCompatibleBitmap SetTextCharacterExtra SetGraphicsMode SelectClipRgn GetTextExtentPoint32W GetTextExtentPoint32A GetTextColor GetTextAlign GetTextCharacterExtra GetCurrentObject RestoreDC SaveDC EnumFontFamiliesExW GetFontData GetBkMode GetBkColor EnumFontFamiliesA CreateRectRgn CreatePen CreateFontIndirectA GetICMProfileA SetPixel CreateFontIndirectW CreateDCA CreateBitmap GetObjectType CreateRectRgnIndirect SetViewportOrgEx LPtoDP Rectangle GetClipBox LineTo SetBkMode EnumFontFamiliesW ExtTextOutW GdiAlphaBlend SetStretchBltMode StretchBlt SetBkColor GetStretchBltMode GetClipRgn

advapi32

DeregisterEventSource CryptAcquireContextA RegOpenKeyA CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey ReportEventW RegisterEventSourceW OpenServiceW OpenSCManagerW CloseServiceHandle CryptGenRandom CryptReleaseContext CryptAcquireContextW RegQueryValueExW RegCreateKeyA RegSetValueExW QueryServiceStatusEx RegSetValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA

shell32

ord165 SHGetFolderPathW SHGetSpecialFolderPathW SHFileOperationW SHAppBarMessage SHGetPathFromIDListW SHGetFolderPathA SHGetFolderLocation SHGetKnownFolderPath SHGetDiskFreeSpaceExW SHGetSettings SHBrowseForFolderW ShellExecuteW

ole32

CoCreateFreeThreadedMarshaler CoUninitialize CreateBindCtx StringFromGUID2 CoTaskMemRealloc CreateDataAdviseHolder CreateOleAdviseHolder CoWaitForMultipleHandles OleRegGetMiscStatus OleRegEnumVerbs ReadClassStm WriteClassStm OleSaveToStream OleInitialize OleUninitialize OleSetClipboard CoInitialize CoTaskMemFree CoTaskMemAlloc PropVariantClear OleRegGetUserType CoCreateInstance OleGetClipboard OleFlushClipboard CoSetProxyBlanket CoRegisterMessageFilter CoAllowSetForegroundWindow CoInitializeEx ReleaseStgMedium OleIsCurrentClipboard

shlwapi

StrStrIW StrRStrIW PathFindFileNameW ord158 UrlCanonicalizeW AssocQueryStringW StrNCatW

urlmon

HlinkSimpleNavigateToMoniker CopyStgMedium RegisterBindStatusCallback CreateURLMoniker

uiautomationcore

UiaGetReservedNotSupportedValue

mscms

OpenColorProfileW CreateColorTransformW DeleteColorTransform TranslateBitmapBits CloseColorProfile

ws2_32

gethostname getpeername WSAAddressToStringA shutdown getsockopt getaddrinfo freeaddrinfo getnameinfo WSAWaitForMultipleEvents WSASend WSARecv WSAGetOverlappedResult WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSASetLastError getservbyname getservbyport gethostbyname ioctlsocket gethostbyaddr setsockopt sendto send recvfrom recv ntohs inet_ntoa inet_addr htons htonl getsockname connect bind __WSAFDIsSet WSASocketW WSAIoctl WSAAsyncSelect WSAGetLastError WSACleanup WSAStartup socket closesocket select ntohl

Name

.text

Size

8.1MB

Virtual Size

8.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

143KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

643KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

408KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=34, id=241, version=40116,

count=184, id=243, version=40116,

count=39, id=242, version=40116,

count=1, id=199, version=41118,

count=27, id=259, version=24123,

count=32, id=260, version=24123,

count=3, id=261, version=23013,

count=18, id=264, version=24233,

count=59, id=261, version=24123,

count=766, id=260, version=24233,

count=4, id=207, version=65501,

count=23, id=206, version=65501,

count=3, id=208, version=65501,

count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=41, id=203, version=65501,

count=725, id=1, productName=Unmarked objects,

count=1028, id=261, version=24233,

count=1, id=256, version=24233,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=6, id=151,

count=1, id=258, version=24233,