db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff

Sharing

Copy URL Twitter E-mail

General

Target
db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff
Size 196KB
Sample260806-sgpyesdr21
SHA256 db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff
MD5 f84dcaeea51a3c14fc1bd0f77261b64f
SHA1 5f6358f4495a25410b4edaded9721bb17cda36c3
SHA512 80bb99e360359eb29b8065790bf98a4c2bb08ce55e44ee0d71c71e1052040a86dc649f80cef34319911a05844548a76ba149c7b3a39a0e510d6acbd3396222f1
SSDEEP 6144:fzQyiLHz40gQt23nJ6vOS0lcc0rbLurxl:7Qvs0N23J6WS0lp0L0x
TLSH
T1C4144A2D22EE10E4E47B917CCC424256E6B27431272262EF15E0C57C9F27AEDBA78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff

File Explorer

db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff

.exe 196KB

db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff

IMPHASH 09ed737a03db7295bf734a9953f6eb5e
SHA256 db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff
MD5 f84dcaeea51a3c14fc1bd0f77261b64f
SHA1 5f6358f4495a25410b4edaded9721bb17cda36c3
SHA512 80bb99e360359eb29b8065790bf98a4c2bb08ce55e44ee0d71c71e1052040a86dc649f80cef34319911a05844548a76ba149c7b3a39a0e510d6acbd3396222f1
SSDEEP 6144:fzQyiLHz40gQt23nJ6vOS0lcc0rbLurxl:7Qvs0N23J6WS0lp0L0x
TLSH
T1C4144A2D22EE10E4E47B917CCC424256E6B27431272262EF15E0C57C9F27AEDBA78F51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

notepad.pdb

kernel32

GetProcAddress CreateMutexExW AcquireSRWLockShared DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW DebugBreak IsDebuggerPresent GlobalFree GetLocaleInfoW CreateFileW ReadFile GetACP MulDiv GetCurrentProcess GetCommandLineW HeapSetInformation FreeLibrary LocalFree LocalAlloc FindFirstFileW FindClose FoldStringW GetModuleFileNameW GetUserDefaultUILanguage HeapFree HeapAlloc GetTimeFormatW WideCharToMultiByte WriteFile GetFileAttributesW LocalLock LocalUnlock DeleteFileW SetEndOfFile GetFileAttributesExW GetFileInformationByHandle CreateFileMappingW MapViewOfFile MultiByteToWideChar LocalReAlloc UnmapViewOfFile GetFullPathNameW LocalSize GetStartupInfoW lstrcmpiW FindNLSString GlobalLock GlobalUnlock GlobalAlloc GetDiskFreeSpaceExW CreateDirectoryW RegisterApplicationRestart CreateSemaphoreExW CreateThreadpoolTimer ReleaseSRWLockShared SetThreadpoolTimer CloseHandle OpenSemaphoreW WaitForSingleObjectEx AcquireSRWLockExclusive CloseThreadpoolTimer OutputDebugStringW ReleaseSRWLockExclusive GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject WaitForThreadpoolTimerCallbacks InitializeCriticalSectionEx LeaveCriticalSection GetModuleHandleExW ReleaseSemaphore EnterCriticalSection GetDateFormatW SetLastError GetLocalTime ResolveDelayLoadedAPI DelayLoadFailureHook GetModuleFileNameA

gdi32

CreateDCW StartPage StartDocW SetAbortProc DeleteDC EndDoc AbortDoc EndPage GetTextMetricsW SetBkMode LPtoDP SetWindowExtEx SetViewportExtEx SetMapMode GetTextExtentPoint32W TextOutW EnumFontsW GetTextFaceW SelectObject DeleteObject CreateFontIndirectW GetDeviceCaps

user32

PostMessageW MessageBoxW GetMenu CheckMenuItem GetSubMenu EnableMenuItem ShowWindow GetDC ReleaseDC SetCursor GetDpiForWindow SetActiveWindow LoadStringW DefWindowProcW IsIconic SetFocus PostQuitMessage DestroyWindow MessageBeep GetForegroundWindow GetDlgCtrlID SetWindowPos RedrawWindow GetKeyboardLayout CharNextW SetWinEventHook GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage DispatchMessageW UnhookWinEvent SetWindowTextW OpenClipboard IsClipboardFormatAvailable CloseClipboard SetDlgItemTextW GetDlgItemTextW EndDialog SendDlgItemMessageW SetScrollPos InvalidateRect UpdateWindow GetWindowPlacement SetWindowPlacement CharUpperW GetSystemMenu LoadAcceleratorsW SetWindowLongW CreateWindowExW MonitorFromWindow RegisterWindowMessageW LoadCursorW RegisterClassExW GetWindowTextLengthW GetWindowLongW PeekMessageW GetWindowTextW EnableWindow CreateDialogParamW DrawTextExW LoadIconW LoadImageW DialogBoxParamW SetThreadDpiAwarenessContext SendMessageW MoveWindow GetClientRect GetFocus

api-ms-win-crt-string-l1-1-0

memset wcsnlen wcscmp

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__callnewh _o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__errno _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wtol _o_exit _o_free _o_iswdigit _o_malloc _o_terminate _o_toupper __CxxFrameHandler3 _CxxThrowException _o___std_exception_destroy _o___std_exception_copy _o___p__commode _o___stdio_common_vswprintf __C_specific_handler memcmp memcpy memmove

api-ms-win-core-com-l1-1-0

CoWaitForMultipleHandles CoUninitialize PropVariantClear CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance CoInitializeEx CoCreateGuid

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsFileSpecW PathFindExtensionW PathFileExistsW

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW

api-ms-win-shcore-path-l1-1-0

ord170

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateStringReference

api-ms-win-core-synch-l1-1-0

SetEvent CreateEventExW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled

api-ms-win-core-synch-l1-2-0

Sleep

comctl32

CreateStatusWindowW ord345

Name

.text

Size

145KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

728B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

db09a714f27003f447574461c894aa23ee0c852d785dc0c5bbe7c5536124b6ff

kernel32

gdi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-shcore-path-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

comctl32

generic