0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6

Sharing

Copy URL Twitter E-mail

General

Target
0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6
Size 3.3MB
Sample260806-pmbffa1arc
SHA256 0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6
MD5 41d9430a13a3858c9db01b3aab00407f
SHA1 ce38491542a044587f6969094667f711d5c51c9a
SHA512 44d0caa71d46653efad12777a7aea5845fda4c15bc3a1d4c5cf9957872f18718387c1b6f74b6c324180f2ea248638e57b6bb6720d02e515e3149b78daa7ef64d
SSDEEP 98304:9PAQCimDBwqW9lsABeQVBR8I3gvhiWaOuBuZXqY7RC0WOy:iQjmmL9lsABeQVBR8fy
TLSH
T1CCF55B11A2D58837E0731E7A9C2BD6D46829BE601E74D94F3FB83A4C5F39B41B824397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6

File Explorer

0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6

.exe 3.3MB

0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6

IMPHASH 36dc8c1d820ad8b059961c15b1f107aa
SHA256 0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6
MD5 41d9430a13a3858c9db01b3aab00407f
SHA1 ce38491542a044587f6969094667f711d5c51c9a
SHA512 44d0caa71d46653efad12777a7aea5845fda4c15bc3a1d4c5cf9957872f18718387c1b6f74b6c324180f2ea248638e57b6bb6720d02e515e3149b78daa7ef64d
SSDEEP 98304:9PAQCimDBwqW9lsABeQVBR8I3gvhiWaOuBuZXqY7RC0WOy:iQjmmL9lsABeQVBR8fy
TLSH
T1CCF55B11A2D58837E0731E7A9C2BD6D46829BE601E74D94F3FB83A4C5F39B41B824397
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2516776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen CreateErrorInfo GetErrorInfo SetErrorInfo GetActiveObject SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegOpenKeyExW RegFlushKey RegDeleteValueW RegCreateKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW LookupAccountSidW LookupAccountNameW GetUserNameW GetTokenInformation DuplicateTokenEx AdjustTokenPrivileges UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceLockStatusW OpenServiceW OpenSCManagerW LockServiceDatabase CloseServiceHandle ChangeServiceConfigW ConvertSidToStringSidW

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage ValidateRect UpdateLayeredWindow UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MoveWindow MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetUpdateRect GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetScrollBarInfo GetPropW GetParent GetWindow GetMessagePos GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCapture GetAncestor GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumDisplaySettingsW EnumClipboardFormats EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint CharToOemA AdjustWindowRectEx ActivateKeyboardLayout GetWindowRgnBox

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrlenW lstrcpyW lstrcmpW WriteProcessMemory WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualProtect VirtualAlloc UnmapViewOfFile TryEnterCriticalSection TerminateProcess SwitchToThread SizeofResource SignalObjectAndWait SetVolumeLabelW SetThreadLocale SetLastError SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SearchPathW ResumeThread ResetEvent ReadProcessMemory ReadFile RaiseException QueryPerformanceCounter QueryDosDeviceW OutputDebugStringW OpenProcess MultiByteToWideChar MulDiv MoveFileExW MoveFileW MapViewOfFile LockResource LocalFree LocalFileTimeToFileTime LocalAlloc LoadResource LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr IsBadCodePtr InitializeCriticalSection HeapFree HeapDestroy HeapAlloc GlobalUnlock GlobalHandle GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetWindowsDirectoryW GetVolumeInformationW GetVersionExW GetVersion GetUserDefaultLangID GetTimeZoneInformation GetTickCount GetThreadLocale GetTempPathW GetTempFileNameW GetSystemTimeAsFileTime GetSystemInfo GetSystemDirectoryW GetSystemDefaultLangID GetStdHandle GetShortPathNameW GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetModuleFileNameW GetLogicalDrives GetLogicalDriveStringsW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileTime GetFileSize GetFileAttributesExW GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameW GetCommandLineW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushInstructionCache FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoW EnterCriticalSection DosDateTimeToFileTime DeviceIoControl DeleteFileW DeleteCriticalSection CreateThread CreateProcessW CreateMutexW CreateFileMappingW CreateFileW CreateEventW CreateDirectoryW CopyFileW CompareStringA CompareStringW CloseHandle Sleep IsDebuggerPresent GetUserDefaultUILanguage ProcessIdToSessionId VerSetConditionMask VerifyVersionInfoW GetLongPathNameW

wintrust

WinVerifyTrust

msimg32

TransparentBlt AlphaBlend

gdi32

UnrealizeObject TextOutW StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixelV SetPixel SetMapMode SetEnhMetaFileBits SetDIBitsToDevice SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt OffsetViewportOrgEx MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetViewportOrgEx GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetTextExtentExPointW GetTextColor GetTextAlign GetSystemPaletteEntries GetStockObject GetRgnBox GetROP2 GetPixel GetPaletteEntries GetObjectType GetObjectW GetNearestPaletteIndex GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetCurrentObject GetClipRgn GetClipBox GetBrushOrgEx GetBkMode GetBkColor GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExcludeClipRect EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePolygonRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

mpr

WNetGetConnectionW

ole32

CreateStreamOnHGlobal OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc ProgIDFromCLSID StringFromCLSID CoCreateInstance CoInitializeSecurity CoUninitialize CoInitialize IsEqualGUID CLSIDFromString CoTaskMemFree StringFromCLSID CoCreateGuid

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls ImageList_GetIconSize

wininet

InternetReadFile InternetOpenW InternetCrackUrlW InternetConnectW InternetCloseHandle HttpSendRequestW HttpOpenRequestW HttpAddRequestHeadersW

shell32

ShellExecuteW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW

comdlg32

GetOpenFileNameW

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

shlwapi

PathMatchSpecW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

crypt32

CertFreeCertificateContext CertGetNameStringA CryptVerifyMessageSignature

imagehlp

ImageGetCertificateData ImageGetCertificateHeader ImageEnumerateCertificates

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

121KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

286KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

143KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

318KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0b7dd5d6eae6f4a7b3a08c10124f9d37499878da5aa734de85ec21fb627f09a6

oleaut32

advapi32

user32

kernel32

wintrust

msimg32

gdi32

version

mpr

ole32

comctl32

wininet

shell32

comdlg32

winspool.drv

shlwapi

winhttp

wtsapi32

crypt32

imagehlp

generic