c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03

Sharing

Copy URL Twitter E-mail

General

Target
c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03
Size 3.3MB
Sample260806-pl81babl8x
SHA256 c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03
MD5 5aa2fa30bafe9bbb167ade244deb3d71
SHA1 ad524929aacb4048c89d6360a5f688390b12c4cb
SHA512 d5dc1a3ea9f259ef109f8e17051d605b09d97de272af763c3556ff50a92940079347c9bdb5f638e45e23b7756b802f89d318313d1ff1708160ff4fbc6da45fcd
SSDEEP 98304:2P+QCimDBwqW9lsABeQVBR8GagvhiWaOuBuZXqY7RC0Wry:FQjmmL9lsABeQVBR8ty
TLSH
T1BBF55B11A3D58837E0731E7A9C2BD6D46829BE601E74D94B3FB83A4C5F39B41B824397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03

File Explorer

c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03

.exe 3.3MB

c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03

IMPHASH 36dc8c1d820ad8b059961c15b1f107aa
SHA256 c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03
MD5 5aa2fa30bafe9bbb167ade244deb3d71
SHA1 ad524929aacb4048c89d6360a5f688390b12c4cb
SHA512 d5dc1a3ea9f259ef109f8e17051d605b09d97de272af763c3556ff50a92940079347c9bdb5f638e45e23b7756b802f89d318313d1ff1708160ff4fbc6da45fcd
SSDEEP 98304:2P+QCimDBwqW9lsABeQVBR8GagvhiWaOuBuZXqY7RC0Wry:FQjmmL9lsABeQVBR8ty
TLSH
T1BBF55B11A3D58837E0731E7A9C2BD6D46829BE601E74D94B3FB83A4C5F39B41B824397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2516776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen CreateErrorInfo GetErrorInfo SetErrorInfo GetActiveObject SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegFlushKey RegDeleteValueW RegCreateKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW LookupAccountSidW LookupAccountNameW GetUserNameW GetTokenInformation DuplicateTokenEx AdjustTokenPrivileges UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceLockStatusW OpenServiceW OpenSCManagerW LockServiceDatabase CloseServiceHandle ChangeServiceConfigW ConvertSidToStringSidW

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage ValidateRect UpdateLayeredWindow UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MoveWindow MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetUpdateRect GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetScrollBarInfo GetPropW GetParent GetWindow GetMessagePos GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCapture GetAncestor GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumDisplaySettingsW EnumClipboardFormats EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint CharToOemA AdjustWindowRectEx ActivateKeyboardLayout GetWindowRgnBox

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrlenW lstrcpyW lstrcmpW WriteProcessMemory WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualProtect VirtualAlloc UnmapViewOfFile TryEnterCriticalSection TerminateProcess SwitchToThread SizeofResource SignalObjectAndWait SetVolumeLabelW SetThreadLocale SetLastError SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SearchPathW ResumeThread ResetEvent ReadProcessMemory ReadFile RaiseException QueryPerformanceCounter QueryDosDeviceW OutputDebugStringW OpenProcess MultiByteToWideChar MulDiv MoveFileExW MoveFileW MapViewOfFile LockResource LocalFree LocalFileTimeToFileTime LocalAlloc LoadResource LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr IsBadCodePtr InitializeCriticalSection HeapFree HeapDestroy HeapAlloc GlobalUnlock GlobalHandle GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetWindowsDirectoryW GetVolumeInformationW GetVersionExW GetVersion GetUserDefaultLangID GetTimeZoneInformation GetTickCount GetThreadLocale GetTempPathW GetTempFileNameW GetSystemTimeAsFileTime GetSystemInfo GetSystemDirectoryW GetSystemDefaultLangID GetStdHandle GetShortPathNameW GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetModuleFileNameW GetLogicalDrives GetLogicalDriveStringsW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileTime GetFileSize GetFileAttributesExW GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameW GetCommandLineW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushInstructionCache FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoW EnterCriticalSection DosDateTimeToFileTime DeviceIoControl DeleteFileW DeleteCriticalSection CreateThread CreateProcessW CreateMutexW CreateFileMappingW CreateFileW CreateEventW CreateDirectoryW CopyFileW CompareStringA CompareStringW CloseHandle Sleep IsDebuggerPresent GetUserDefaultUILanguage ProcessIdToSessionId VerSetConditionMask VerifyVersionInfoW GetLongPathNameW

wintrust

WinVerifyTrust

msimg32

TransparentBlt AlphaBlend

gdi32

UnrealizeObject TextOutW StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixelV SetPixel SetMapMode SetEnhMetaFileBits SetDIBitsToDevice SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt OffsetViewportOrgEx MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetViewportOrgEx GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetTextExtentExPointW GetTextColor GetTextAlign GetSystemPaletteEntries GetStockObject GetRgnBox GetROP2 GetPixel GetPaletteEntries GetObjectType GetObjectW GetNearestPaletteIndex GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetCurrentObject GetClipRgn GetClipBox GetBrushOrgEx GetBkMode GetBkColor GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExcludeClipRect EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePolygonRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

mpr

WNetGetConnectionW

ole32

CreateStreamOnHGlobal OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc ProgIDFromCLSID StringFromCLSID CoCreateInstance CoInitializeSecurity CoUninitialize CoInitialize IsEqualGUID CLSIDFromString CoTaskMemFree StringFromCLSID CoCreateGuid

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls ImageList_GetIconSize

wininet

InternetReadFile InternetOpenW InternetCrackUrlW InternetConnectW InternetCloseHandle HttpSendRequestW HttpOpenRequestW HttpAddRequestHeadersW

shell32

ShellExecuteW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW

comdlg32

GetOpenFileNameW

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

shlwapi

PathMatchSpecW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

crypt32

CertFreeCertificateContext CertGetNameStringA CryptVerifyMessageSignature

imagehlp

ImageGetCertificateData ImageGetCertificateHeader ImageEnumerateCertificates

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

280KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

143KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

318KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c10e2fc406dc948add9bce2e52694c895773590eb442f50724c34da75fb68b03

oleaut32

advapi32

user32

kernel32

wintrust

msimg32

gdi32

version

mpr

ole32

comctl32

wininet

shell32

comdlg32

winspool.drv

shlwapi

winhttp

wtsapi32

crypt32

imagehlp

generic