f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54

Sharing

Copy URL Twitter E-mail

General

Target
f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54
Size 5.8MB
Sample260807-mqteback3w
SHA256 f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54
MD5 df5d17617cd9856bb952a7d1b1cf14ca
SHA1 fe86e5650a87b2705324f96e25312b1a8039fb61
SHA512 7ba724f83d3d930fbb42e6fc7fa8223fdad89197a1fcfa3faf2c089d22f1f43544286d987478ca64ebc83e0ce5a23bf9efa137142ec5e62464363b230acd1c4e
SSDEEP 49152:s89dXb4stWQuo+rA8mqM4PqKnLcFKgM9mt2In3ar9D8CnKb634ZJKjVf7K2VWiAY:s89KsRV4KMA2fp1xAlZFknbx
TLSH
T1F7568F83E2D2C2EFC15DC075B153B133E2277C4A0A2D619B7BD57F146EB1B508A0A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54

File Explorer

f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54

.exe 5.8MB

f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54

IMPHASH 0572ba50646a0da23acc102c44d0e456
SHA256 f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54
MD5 df5d17617cd9856bb952a7d1b1cf14ca
SHA1 fe86e5650a87b2705324f96e25312b1a8039fb61
SHA512 7ba724f83d3d930fbb42e6fc7fa8223fdad89197a1fcfa3faf2c089d22f1f43544286d987478ca64ebc83e0ce5a23bf9efa137142ec5e62464363b230acd1c4e
SSDEEP 49152:s89dXb4stWQuo+rA8mqM4PqKnLcFKgM9mt2In3ar9D8CnKb634ZJKjVf7K2VWiAY:s89KsRV4KMA2fp1xAlZFknbx
TLSH
T1F7568F83E2D2C2EFC15DC075B153B133E2277C4A0A2D619B7BD57F146EB1B508A0A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3548104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CDriveSweeper.pdb

kernel32

GetFileInformationByHandleEx GetSystemInfo GetLastError CloseHandle SetFileInformationByHandle SetFileAttributesW GetLogicalDriveStringsW GetDiskFreeSpaceExW MultiByteToWideChar GlobalFree lstrlenW GetModuleHandleA Sleep GetSystemTimeAsFileTime GetModuleFileNameW LoadLibraryExW FindNextFileW DeleteFileW RemoveDirectoryW DuplicateHandle GetFileAttributesW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FindFirstFileExW SetFileTime GetFullPathNameW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle SetLastError GetFileInformationByHandle SetThreadErrorMode FreeLibrary GetProcAddress WideCharToMultiByte FindClose GetModuleHandleW QueryPerformanceFrequency WriteFileEx SleepEx ReadFileEx GetEnvironmentVariableW HeapAlloc RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentDirectoryW CreateThread GlobalSize SetWaitableTimer CreateWaitableTimerExW GetCurrentThreadId LoadLibraryW HeapReAlloc HeapFree IsProcessorFeaturePresent GlobalUnlock GlobalLock GlobalAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SwitchToThread GetExitCodeProcess WaitForSingleObject QueryPerformanceCounter CreateFileW CreateDirectoryW ExitProcess GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter FormatMessageW GetProcessHeap

advapi32

RegEnumValueW RegGetValueW RegEnumKeyExW RegDeleteValueW RegCloseKey RegDeleteTreeW RegOpenKeyExW ImpersonateAnonymousToken RevertToSelf

shell32

IsUserAnAdmin DragFinish SHEmptyRecycleBinW SHQueryRecycleBinW DragQueryFileW ShellExecuteW SHGetKnownFolderPath

user32

SetClipboardData PostMessageW GetActiveWindow GetSystemMetrics SendMessageW IsWindowVisible CreateIconFromResourceEx SetCursorPos SetWindowTextW GetForegroundWindow MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW TranslateMessage DestroyWindow CreateWindowExW SetWindowLongPtrW RegisterRawInputDevices GetClientRect FlashWindowEx SetWindowPos CreateIcon CountClipboardFormats GetWindowTextW CloseClipboard GetWindowPlacement EmptyClipboard DefWindowProcW RegisterClipboardFormatW IsIconic GetRawInputData SetForegroundWindow SendInput MapVirtualKeyW IsProcessDPIAware GetAsyncKeyState ShowCursor ClipCursor GetClipCursor GetWindowRect ReleaseCapture SetCapture GetCursorPos SetCursor LoadCursorW TrackMouseEvent GetKeyboardState ToUnicodeEx GetKeyState MapVirtualKeyExW GetKeyboardLayout SystemParametersInfoA GetClassNameW GetWindowTextLengthW AdjustWindowRectEx GetMenu GetWindowLongW GetWindowLongPtrW SetWindowDisplayAffinity OpenClipboard MessageBoxW SetWindowPlacement IsClipboardFormatAvailable DestroyCursor DestroyIcon RegisterWindowMessageA SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow GetClipboardData GetMonitorInfoW ChangeDisplaySettingsExW MonitorFromWindow GetClassInfoExW CreateIconIndirect InvalidateRgn RegisterClassExW ClientToScreen GetTouchInputInfo GetDC MonitorFromPoint ReleaseDC ScreenToClient CloseTouchInputHandle ValidateRect MonitorFromRect RegisterTouchWindow EnumDisplayMonitors RedrawWindow

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile NtCreateNamedPipeFile NtOpenFile

combase

CoTaskMemFree

ole32

RevokeDragDrop CoInitializeEx CoUninitialize RegisterDragDrop CoCreateInstance OleInitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

gdi32

ChoosePixelFormat DescribePixelFormat SwapBuffers CreateCompatibleBitmap SetBitmapBits CreateBitmap SetPixelFormat CreateRectRgn GetDeviceCaps DeleteObject

opengl32

wglShareLists wglDeleteContext wglCreateContext wglGetCurrentContext wglGetCurrentDC wglGetProcAddress wglMakeCurrent

imm32

ImmSetCandidateWindow ImmGetCompositionStringW ImmAssociateContextEx ImmReleaseContext ImmGetContext ImmSetCompositionWindow

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

vcruntime140

memmove __C_specific_handler memcmp __current_exception __current_exception_context __CxxFrameHandler3 memcpy memset

api-ms-win-crt-math-l1-1-0

cbrtf sinf round trunc fmod _hypotf log2 atan2f cbrt fma atan2 cosf _hypot __setusermatherr floorf powf roundf cos ceilf tanf sin log tan pow floor exp2f ceil expf truncf acosf

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

strerror terminate _crt_atexit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc _register_onexit_function __p___argv _cexit _c_exit _initialize_onexit_table _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

f031d24971436d9ddd0c180d7090f8a3e1df79d57e7e67a1797fb9c654ac4c54

kernel32

advapi32

shell32

user32

ntdll

combase

ole32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

gdi32

opengl32

imm32

uxtheme

dwmapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic