ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588

Sharing

Copy URL Twitter E-mail

General

Target
ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588
Size 2.1MB
Sample260807-k2kkfa1ekf
SHA256 ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588
MD5 5a72b5d10fd9f93a189cfa45ebb53a03
SHA1 1192870e21cc7465c6f99fb3a46a0ac0c78086ee
SHA512 e7c5387f7c8206ca122e08047b2817ed8b0870a886b59a0c44c0d6d9c4c5e3742b15b5c2b2a34ffc035ee851b181a60267502e0ddc6dd183df34befa66e9a590
SSDEEP 49152:UHzPNCnuiA4kZfFAVTs4CUewtn+F2PLoilgMB:2PNCnvrWFV4CUewd+F2d
TLSH
T182A57E107541D537E8FB00F69BBD599F4A2CAF70032450CF63C8686A9A7ACE2BB35617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588

File Explorer

ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588

.dll 2.1MB

ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588

IMPHASH 1c6ece82b8536152e1d14793142939b5
SHA256 ff4a1fd6a35f0d5eb5aae2e017d1a5a2b4f1ebf853dbc00dcffd7d97e4d9f588
MD5 5a72b5d10fd9f93a189cfa45ebb53a03
SHA1 1192870e21cc7465c6f99fb3a46a0ac0c78086ee
SHA512 e7c5387f7c8206ca122e08047b2817ed8b0870a886b59a0c44c0d6d9c4c5e3742b15b5c2b2a34ffc035ee851b181a60267502e0ddc6dd183df34befa66e9a590
SSDEEP 49152:UHzPNCnuiA4kZfFAVTs4CUewtn+F2PLoilgMB:2PNCnvrWFV4CUewd+F2d
TLSH
T182A57E107541D537E8FB00F69BBD599F4A2CAF70032450CF63C8686A9A7ACE2BB35617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1035109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\src\_LdsCode\general_use\mg_faiconshelper\Release\BwSystemHelper.pdb

kernel32

lstrcmpiW QueryDosDeviceW GetLogicalDriveStringsW CreateDirectoryW GetTickCount CreateThread Sleep CreateMutexW ReleaseMutex WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent WideCharToMultiByte WritePrivateProfileStringW lstrcpyW GetPrivateProfileIntW OpenProcess LoadLibraryW FreeLibrary FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleFileNameW FindResourceExW GetTickCount64 GetStartupInfoW CreateProcessW GetCurrentProcess CloseHandle GetPrivateProfileStringW K32GetProcessImageFileNameW MultiByteToWideChar GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap InitOnceBeginInitialize HeapSize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW EncodePointer CompareStringEx GetCPInfo LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime LocalFree InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW GetACP GetCurrentDirectoryW CreateFileW GetFileSize ReadFile GlobalUnlock GlobalLock MulDiv lstrlenW ExitProcess GetFileAttributesW LocalFileTimeToFileTime SetFilePointer SetFileTime WriteFile SystemTimeToFileTime FormatMessageW InitializeCriticalSectionAndSpinCount VerSetConditionMask GetCurrentProcessId VerifyVersionInfoW FreeResource GlobalAlloc lstrcmpW GetLocalTime lstrcpynW DeleteFileW FlushFileBuffers WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess CreateFileA FindClose FindFirstFileA FindNextFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemWindowsDirectoryW GetVersionExW LoadLibraryExW DeviceIoControl lstrcmpA GetStdHandle GetFileType GetModuleHandleA GetFileSizeEx FindNextFileW RtlUnwind InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW SetFilePointerEx GetConsoleOutputCP GetConsoleMode GetTimeZoneInformation CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile WriteConsoleW HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException InitOnceComplete DecodePointer

user32

DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen UpdateWindow EqualRect SetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo GetKeyboardLayout GetKeyNameTextW MapVirtualKeyExW GetProcessWindowStation GetUserObjectInformationW MessageBoxA EnableWindow SetFocus IsZoomed RegisterClassW BeginPaint wsprintfW IsIconic DefWindowProcW CallWindowProcW OffsetRect UnionRect UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW GetWindowRgn IsWindowEnabled MoveWindow UpdateLayeredWindow MessageBoxW SetWindowRgn PtInRect CharPrevW IsRectEmpty IntersectRect GetSysColor MapWindowPoints ScreenToClient GetCursorPos ReleaseCapture InflateRect InvalidateRect GetUpdateRect SetForegroundWindow SetCapture EndPaint MonitorFromWindow ReleaseDC GetDC PostThreadMessageW PeekMessageW GetWindowTextW IsWindowVisible PostQuitMessage DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetWindowThreadProcessId GetClientRect SetWindowPos PostMessageW LoadCursorW SetWindowLongW GetWindowLongW GetWindowRect KillTimer SetTimer DestroyWindow IsWindow GetKeyState GetFocus SendMessageW GetActiveWindow SetCursor CharNextW GetMonitorInfoW LoadImageW GetWindow GetParent GetPropW ShowWindow SetPropW

gdi32

PtInRegion CreateDIBSection CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W SaveDC SelectClipRgn ExtSelectClipRgn SetBkColor CreateRectRgn CreateRoundRectRgn Rectangle RemoveFontMemResourceEx AddFontMemResourceEx GetBitmapBits GetDeviceCaps SetBkMode StretchBlt SetStretchBltMode SetTextColor MoveToEx TextOutW GdiFlush SetBitmapBits GetStockObject SetWindowOrgEx GetObjectW GetTextMetricsW PlayEnhMetaFile GetEnhMetaFileHeader CreateEnhMetaFileW CloseEnhMetaFile RestoreDC SelectObject GetTextExtentPointA DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateDIBitmap CreateCompatibleDC CreateCompatibleBitmap LineTo BitBlt CreatePatternBrush

advapi32

OpenProcessToken GetTokenInformation RegCreateKeyExW RegSetValueExW DeregisterEventSource RegisterEventSourceA ReportEventA RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

shell32

DragQueryFileW ShellExecuteW SHCreateDirectoryExW

ole32

CoUninitialize CoCreateGuid CoCreateInstance DoDragDrop OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoInitialize OleLockRunning

oleaut32

SysAllocStringLen SysFreeString VariantInit SysStringLen VariantClear SysAllocString

shlwapi

StrStrIW StrCmpNIW PathCombineW PathFileExistsW PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathRemoveExtensionW StrTrimA StrStrIA StrCmpIW PathIsDirectoryW PathIsRelativeW PathIsRootW PathAppendW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipDrawImageI GdipCreatePen2 GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdipSetPenEndCap GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipDrawImageRectI GdipTranslateWorldTransform GdipSetPenStartCap GdipRotateWorldTransform GdipImageGetFrameDimensionsList GdipDrawLine GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLine GdipAddPathArc GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCreateFromHDC GdipDeleteGraphics GdipReleaseDC GdipSetSmoothingMode GdipSetWorldTransform GdipResetWorldTransform GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawImageRectRect GdipGetImageWidth

ws2_32

gethostname gethostbyname WSAStartup

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

comctl32

InitCommonControlsEx _TrackMouseEvent ord17

msimg32

AlphaBlend

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext

generic

count=35, id=259, version=30795,

count=212, id=261, version=30795,

count=3, productName=Unmarked objects (old),

count=21, id=260, version=35211,

count=1, id=261, version=35211,

count=11, id=260, version=35228,

count=20, id=260, version=35207,

count=6, id=265, version=35228,

count=15, id=261, version=35213,

count=55, id=261, version=27054,

count=1, id=263, version=30795,

count=28, id=259, version=35207,

count=93, id=261, version=35207,

count=46, id=260, version=30795,

count=1, id=262, version=30795,

count=37, id=257, version=30795,

count=507, id=1, productName=Unmarked objects,

count=24, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,