6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0

Sharing

Copy URL Twitter E-mail

General

Target
6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0
Size 3.2MB
Sample260806-ppn5babm71
SHA256 6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0
MD5 4764ed868518aa5a219f48dae87fd37a
SHA1 2ec61c55ef5d76799cf1cf9722fad91e3dc75eae
SHA512 654bafffbd750b30139ed0112867555b48640b10292a036999131ff86779c0a18f09ccbcbd94b239039f40b9f095c315598675bcaac948c24656aa7e3982fc1c
SSDEEP 98304:2yFCdPLjjyYqhQL8f7C2Ov9gvhiWaOuBuZXqY7RC0WstYy:2ysdPvmlhQL8f7C2OZy
TLSH
T15CF55C11A3D58837E0732E7A9C2BD6D46829BE601E74994B3FB83A4C5F3AF417824357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0

File Explorer

6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0

.exe 3.2MB

6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0

IMPHASH c191289bc857f61f3894a3edbda00f73
SHA256 6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0
MD5 4764ed868518aa5a219f48dae87fd37a
SHA1 2ec61c55ef5d76799cf1cf9722fad91e3dc75eae
SHA512 654bafffbd750b30139ed0112867555b48640b10292a036999131ff86779c0a18f09ccbcbd94b239039f40b9f095c315598675bcaac948c24656aa7e3982fc1c
SSDEEP 98304:2yFCdPLjjyYqhQL8f7C2Ov9gvhiWaOuBuZXqY7RC0WstYy:2ysdPvmlhQL8f7C2OZy
TLSH
T15CF55C11A3D58837E0732E7A9C2BD6D46829BE601E74994B3FB83A4C5F3AF417824357
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2475816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen CreateErrorInfo GetErrorInfo SetErrorInfo GetActiveObject SysFreeString SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegFlushKey RegEnumValueW RegDeleteValueW RegCreateKeyExW RegCloseKey OpenProcessToken LookupPrivilegeValueW LookupAccountSidW LookupAccountNameW GetUserNameW GetTokenInformation DuplicateTokenEx AdjustTokenPrivileges UnlockServiceDatabase StartServiceW QueryServiceStatus QueryServiceLockStatusW OpenServiceW OpenSCManagerW LockServiceDatabase CloseServiceHandle ChangeServiceConfigW ConvertSidToStringSidW

user32

GetKeyboardType LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage ValidateRect UpdateLayeredWindow UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageTimeoutW SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PtInRect PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect OemToCharA MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MoveWindow MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetUpdateRect GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetScrollBarInfo GetPropW GetParent GetWindow GetMessagePos GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDlgItem GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameW GetClassLongW GetClassInfoW GetCapture GetAncestor GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumDisplaySettingsW EnumClipboardFormats EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint CharToOemA AdjustWindowRectEx ActivateKeyboardLayout GetWindowRgnBox

kernel32

GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte SetCurrentDirectoryW MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW GetThreadLocale GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLastError GetCurrentDirectoryW GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW lstrcmpW WriteProcessMemory WritePrivateProfileStringW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualProtect VirtualAlloc UnmapViewOfFile TryEnterCriticalSection TerminateProcess SwitchToThread SizeofResource SignalObjectAndWait SetVolumeLabelW SetThreadLocale SetLastError SetFileTime SetFilePointer SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SearchPathW ResumeThread ResetEvent RemoveDirectoryW ReleaseSemaphore ReadProcessMemory ReadFile RaiseException QueryPerformanceCounter QueryDosDeviceW PeekNamedPipe OutputDebugStringW OpenProcess OpenMutexW MultiByteToWideChar MulDiv MoveFileExW MoveFileW MapViewOfFile LockResource LocalFree LocalFileTimeToFileTime LocalAlloc LoadResource LoadLibraryW LeaveCriticalSection IsValidLocale IsBadReadPtr IsBadCodePtr InitializeCriticalSection HeapFree HeapDestroy HeapAlloc GlobalUnlock GlobalHandle GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetWindowsDirectoryW GetVolumeInformationW GetVersionExW GetVersion GetUserDefaultLangID GetTimeZoneInformation GetTickCount GetThreadLocale GetTempPathW GetTempFileNameW GetSystemTimeAsFileTime GetSystemInfo GetSystemDirectoryW GetSystemDefaultLangID GetStdHandle GetShortPathNameW GetProcAddress GetPrivateProfileStringW GetModuleHandleW GetModuleFileNameW GetLogicalDrives GetLogicalDriveStringsW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileTime GetFileSize GetFileAttributesExW GetFileAttributesW GetExitCodeThread GetExitCodeProcess GetEnvironmentVariableW GetDriveTypeW GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetComputerNameW GetCommandLineW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchangeAdd InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageW FlushInstructionCache FindResourceW FindNextFileW FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime EnumCalendarInfoW EnterCriticalSection DosDateTimeToFileTime DeviceIoControl DeleteFileW DeleteCriticalSection CreateThread CreateProcessW CreatePipe CreateMutexW CreateFileMappingW CreateFileW CreateEventW CreateDirectoryW CopyFileW CompareStringA CompareStringW CloseHandle Sleep IsDebuggerPresent GetUserDefaultUILanguage ProcessIdToSessionId VerSetConditionMask VerifyVersionInfoW GetLongPathNameW

msimg32

TransparentBlt AlphaBlend

gdi32

UnrealizeObject TextOutW StretchDIBits StretchBlt StartPage StartDocW SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixelV SetPixel SetMapMode SetEnhMetaFileBits SetDIBitsToDevice SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SetAbortProc SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette Polyline PlayEnhMetaFile PatBlt OffsetViewportOrgEx MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetViewportOrgEx GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetTextExtentExPointW GetTextColor GetTextAlign GetSystemPaletteEntries GetStockObject GetRgnBox GetROP2 GetPixel GetPaletteEntries GetObjectType GetObjectW GetNearestPaletteIndex GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetCurrentObject GetClipRgn GetClipBox GetBrushOrgEx GetBkMode GetBkColor GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExcludeClipRect EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgn CreatePolygonRgn CreatePenIndirect CreatePalette CreateICW CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW BitBlt

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

mpr

WNetGetConnectionW

ole32

CreateStreamOnHGlobal OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc ProgIDFromCLSID StringFromCLSID CoCreateInstance CoInitializeSecurity CoUninitialize CoInitialize IsEqualGUID CLSIDFromString CoTaskMemFree StringFromCLSID CoCreateGuid

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls ImageList_GetIconSize

shell32

ShellExecuteW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderPathW

comdlg32

GetOpenFileNameW

winspool.drv

OpenPrinterW EnumPrintersW DocumentPropertiesW ClosePrinter GetDefaultPrinterW

wsock32

closesocket

shlwapi

PathMatchSpecW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

ntdll

NtQueryInformationProcess

Name

.text

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

120KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

280KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

141KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

318KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6e768352b8d7813c4691a329b9981f1d7c973c039ce5dbac89766035738215d0

oleaut32

advapi32

user32

kernel32

msimg32

gdi32

version

mpr

ole32

comctl32

shell32

comdlg32

winspool.drv

wsock32

shlwapi

winhttp

wtsapi32

ntdll

generic