4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5

Sharing

Copy URL Twitter E-mail

General

Target
4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5
Size 753KB
Sample260806-e6vy3sx1ew
SHA256 4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5
MD5 43dcc6048b01e5eeb87bbbff7415ed1c
SHA1 588219ca387d9d78968299448d039356b0381513
SHA512 505da974596111e962ae29aa4a00d75f643322369f9ffbb27f9e029eafe52ce8bd19a19e3e41c3215c5c327cc6e99e86dbd64edfccd69196cf485c4ed1363d58
SSDEEP 6144:c+5BEWbCc6WnyPe9L44q+l48ZIW+xwyRxZtKGDBOhH0b:JHFWEn99L4n+l48ZIW+xJKjhH0b
TLSH
T158F46C40B2A5ACBAD92A8334496393327739BD8167629B271A0C9D780F33FC57E54F35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5

File Explorer

4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5

.dll 753KB

4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5

IMPHASH c907593351158c0ce9fb88fe8bbf62c2
SHA256 4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5
MD5 43dcc6048b01e5eeb87bbbff7415ed1c
SHA1 588219ca387d9d78968299448d039356b0381513
SHA512 505da974596111e962ae29aa4a00d75f643322369f9ffbb27f9e029eafe52ce8bd19a19e3e41c3215c5c327cc6e99e86dbd64edfccd69196cf485c4ed1363d58
SSDEEP 6144:c+5BEWbCc6WnyPe9L44q+l48ZIW+xwyRxZtKGDBOhH0b:JHFWEn99L4n+l48ZIW+xJKjhH0b
TLSH
T158F46C40B2A5ACBAD92A8334496393327739BD8167629B271A0C9D780F33FC57E54F35
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

212112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyW RegQueryValueExW

comctl32

CreateStatusWindowW ImageList_Destroy ImageList_LoadImageW

gdi32

GetDeviceCaps

kernel32

ActivateActCtx CloseHandle CreateActCtxW CreateFileW CreateProcessW DeactivateActCtx DisableThreadLibraryCalls EnumResourceNamesW ExitProcess FindClose FindFirstFileW FindNextFileW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetTickCount GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MulDiv MultiByteToWideChar ReleaseActCtx SizeofResource WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpW lstrcmpiW

ntdll

_vsnprintf

ole32

CoCreateInstance CoInitialize CoRegisterClassObject CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CreateOleAdviseHolder CreateStreamOnHGlobal OleRegGetUserType PropVariantClear StgCreateStorageEx

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear SafeArrayDestroy SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement LoadRegTypeLib SafeArrayCreateVector

shell32

SHGetFolderPathW ShellAboutW ShellExecuteExW

shlwapi

ord167 PathAppendW PathCreateFromUrlW PathFindExtensionW PathIsURLW SHRegCloseUSKey SHRegEnumUSValueW SHRegOpenUSKeyW SHRegQueryUSValueW UrlApplySchemeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsdup _wcsnicmp calloc free fwrite getenv malloc memcmp memcpy memmove realloc strchr strcmp strcspn strlen wcschr wcslen wcsncmp wcstol

urlmon

CoInternetParseUrl CreateAsyncBindCtx CreateURLMoniker CreateURLMonikerEx2 ReleaseBindInfo

user32

CreatePopupMenu CreateWindowExW DdeCmpStringHandles DdeCreateStringHandleW DdeFreeStringHandle DdeGetData DdeGetLastError DdeInitializeW DdeNameService DdeUninitialize DefWindowProcW DestroyIcon DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClientRect GetDC GetDlgItem GetMenuItemCount GetMenuItemInfoW GetMessageW GetPropW GetSubMenu GetSystemMetrics GetWindowLongPtrW GetWindowTextLengthW GetWindowTextW InsertMenuItemW IsWindowVisible LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW PostMessageW PostQuitMessage RegisterClassExW ReleaseDC SendMessageW SetFocus SetMenu SetPropW SetWindowLongPtrW SetWindowPos ShowWindow TranslateMessage UnregisterClassW

Name

.text

Size

208KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

108KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

472B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4ebb42f59cfe51ff043b42fb0095bc22c68c5a018b3feb6e7af61456ebe4c6e5

advapi32

comctl32

gdi32

kernel32

ntdll

ole32

oleaut32

shell32

shlwapi

ucrtbase

urlmon

user32

generic