13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168

Sharing

Copy URL Twitter E-mail

General

Target
13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168
Size 889KB
Sample260806-e6vy3sfg36
SHA256 13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168
MD5 60aea166f40c1d88550897b860a3e68c
SHA1 e00c37d2609d8af4b66bb9ca10ab29fbfc9a8e27
SHA512 2a265f4fe39020af64313093a4a9993784b7f223743f7e671ba36f8a83e12ebd58b0d99268037f0c26208755b1661a37f5af58445b41e01da8034c0d31e27511
SSDEEP 12288:NjEjNM16W0Vr24g5YZAJ9YJLKhMqhJQWckNOCAG0dsRWeA9yt:N4pMwW0Vr24guZpCEkNueA9yt
TLSH
T171153B50B2A1DDADC96AC33445A7A333BBB8BD810376AB272248DD751F53FD06D58B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168

File Explorer

13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168

.dll 889KB

13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168

IMPHASH a052e9497389c830f6a7cd671b6384c2
SHA256 13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168
MD5 60aea166f40c1d88550897b860a3e68c
SHA1 e00c37d2609d8af4b66bb9ca10ab29fbfc9a8e27
SHA512 2a265f4fe39020af64313093a4a9993784b7f223743f7e671ba36f8a83e12ebd58b0d99268037f0c26208755b1661a37f5af58445b41e01da8034c0d31e27511
SSDEEP 12288:NjEjNM16W0Vr24g5YZAJ9YJLKhMqhJQWckNOCAG0dsRWeA9yt:N4pMwW0Vr24guZpCEkNueA9yt
TLSH
T171153B50B2A1DDADC96AC33445A7A333BBB8BD810376AB272248DD751F53FD06D58B20
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

354816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DelayLoadFailureHook DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW FreeLibrary GetDriveTypeW GetEnvironmentVariableW GetFileAttributesW GetFileSizeEx GetFileTime GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GlobalAlloc GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeCriticalSection IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource MultiByteToWideChar RaiseException ReadFile RemoveDirectoryW ResolveDelayLoadedAPI RtlUnwind SetFilePointerEx SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue WideCharToMultiByte lstrcmpiW

ntdll

RtlIpv6AddressToStringExW RtlIpv6StringToAddressW _vsnprintf

ole32

CLIPFORMAT_UserFree CLIPFORMAT_UserMarshal CLIPFORMAT_UserSize CLIPFORMAT_UserUnmarshal CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoMarshalInterface CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUnmarshalInterface CreateBindCtx CreateGenericComposite CreateStreamOnHGlobal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal MkParseDisplayName ReleaseStgMedium STGMEDIUM_UserFree STGMEDIUM_UserMarshal STGMEDIUM_UserSize STGMEDIUM_UserUnmarshal StringFromCLSID

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen BSTR_UserSize BSTR_UserMarshal BSTR_UserUnmarshal BSTR_UserFree

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrAllocate NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrClearOutParameters NdrConformantArrayBufferSize NdrConformantArrayFree NdrConformantArrayMarshall NdrConformantArrayUnmarshall NdrConformantStringBufferSize NdrConformantStringMarshall NdrConformantStringUnmarshall NdrConformantStructBufferSize NdrConformantStructMarshall NdrConformantStructUnmarshall NdrConvert NdrDllCanUnloadNow NdrDllGetClassObject NdrInterfacePointerBufferSize NdrInterfacePointerFree NdrInterfacePointerMarshall NdrInterfacePointerUnmarshall NdrOleAllocate NdrOleFree NdrPointerBufferSize NdrPointerFree NdrPointerMarshall NdrPointerUnmarshall NdrProxyErrorHandler NdrProxyFreeBuffer NdrProxyGetBuffer NdrProxyInitialize NdrProxySendReceive NdrSimpleStructMarshall NdrSimpleStructUnmarshall NdrSimpleTypeMarshall NdrSimpleTypeUnmarshall NdrStubGetBuffer NdrStubInitialize NdrUserMarshalBufferSize NdrUserMarshalMarshall NdrUserMarshalUnmarshall RpcRaiseException

shell32

ShellExecuteExW

shlwapi

ord2 PathCreateFromUrlW PathFindExtensionW StrChrW StrCmpNIW StrCmpNW UrlCanonicalizeW UrlCombineW UrlCompareW UrlGetPartW UrlUnescapeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _recalloc _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv iswalpha iswcntrl iswspace iswupper malloc memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen towlower wcschr wcscmp wcscpy wcslen wcsrchr wcstol

user32

CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetDlgItem GetPropW KillTimer LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW PostMessageW RegisterClassExW RegisterClipboardFormatW SendDlgItemMessageW SetDlgItemTextW SetPropW SetTimer TranslateMessage UnregisterClassW wsprintfW

wininet

CommitUrlCacheEntryW CreateUrlCacheEntryW FtpGetFileSize HttpEndRequestW HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestExW HttpSendRequestW InternetCloseHandle InternetConnectW InternetErrorDlg InternetLockRequestFile InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetReadFile InternetSetOptionW InternetSetStatusCallbackW InternetUnlockRequestFile InternetWriteFile

AsyncGetClassBits AsyncInstallDistributionUnit BindAsyncMoniker CDLGetLongPathNameA CDLGetLongPathNameW CoGetClassObjectFromURL CoInstall CoInternetCombineIUri CoInternetCombineUrl CoInternetCombineUrlEx CoInternetCompareUrl CoInternetCreateSecurityManager CoInternetCreateZoneManager CoInternetGetProtocolFlags CoInternetGetSecurityUrl CoInternetGetSecurityUrlEx CoInternetGetSession CoInternetIsFeatureEnabled CoInternetIsFeatureEnabledForUrl CoInternetIsFeatureZoneElevationEnabled CoInternetParseIUri CoInternetParseUrl CoInternetQueryInfo CoInternetSetFeatureEnabled CompareSecurityIds CopyBindInfo CopyStgMedium CreateAsyncBindCtx CreateAsyncBindCtxEx CreateFormatEnumerator CreateIUriBuilder CreateURLMoniker CreateURLMonikerEx CreateURLMonikerEx2 CreateUri CreateUriWithFragment DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllRegisterServerEx DllUnregisterServer Extract FaultInIEFeature FindMediaType FindMediaTypeClass FindMimeFromData GetClassFileOrMime GetClassURL GetComponentIDFromCLSSPEC GetIUriPriv GetMarkOfTheWeb GetSoftwareUpdateInfo HlinkGoBack HlinkGoForward HlinkNavigateMoniker HlinkNavigateString HlinkSimpleNavigateToMoniker HlinkSimpleNavigateToString IEInstallScope IsAsyncMoniker IsLoggingEnabledA IsLoggingEnabledW IsValidURL MkParseDisplayNameEx ObtainUserAgentString PrivateCoInstall RegisterBindStatusCallback RegisterFormatEnumerator RegisterMediaTypeClass RegisterMediaTypes ReleaseBindInfo RevokeBindStatusCallback RevokeFormatEnumerator SetSoftwareUpdateAdvertisementState ShouldShowIntranetWarningSecband URLDownloadA URLDownloadToCacheFileA URLDownloadToCacheFileW URLDownloadToFileA URLDownloadToFileW URLDownloadW URLOpenBlockingStreamA URLOpenBlockingStreamW URLOpenPullStreamA URLOpenPullStreamW URLOpenStreamA URLOpenStreamW UrlMkBuildVersion UrlMkGetSessionOption UrlMkSetSessionOption WriteHitLogging ZonesReInit

Name

.text

Size

352KB

Virtual Size

348KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

16KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

60KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

13736b2c670c88e85834cb15c6d842545412138a91f0afa3fa6aa018484be168

advapi32

kernel32

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

ucrtbase

user32

wininet

generic