a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac

Sharing

Copy URL Twitter E-mail

General

Target
a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac
Size 500KB
Sample260808-d3vcpsgr7x
SHA256 a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac
MD5 252b709e4475cb55c1c9c2ebfaaedb5b
SHA1 11b1150dde2fe8d8d96647f6efde6f670f13ddc3
SHA512 b12dae92fa7d43bce15d9296fa3d7800a40f397f0a5f30771ac52a00a4e3c54e203a95bf50243427bd1500e9aa7fae3ddb3eaad24a52a1e4c4dbae6efb56f9a9
SSDEEP 12288:QjgQluXGUMxL/qJBVLdBGZ+HrEMS+l48ZIWrkbf:Qjg1u/qTVLdBGZ+LFr4
TLSH
T1D2B41A05F39685E3D8270A70496EF7BF5A2CBA11F9609E6AFB0CCD491F72A617230714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac

File Explorer

a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac

.dll 500KB

a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac

IMPHASH 13e77486febd820d52399e21af0dba71
SHA256 a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac
MD5 252b709e4475cb55c1c9c2ebfaaedb5b
SHA1 11b1150dde2fe8d8d96647f6efde6f670f13ddc3
SHA512 b12dae92fa7d43bce15d9296fa3d7800a40f397f0a5f30771ac52a00a4e3c54e203a95bf50243427bd1500e9aa7fae3ddb3eaad24a52a1e4c4dbae6efb56f9a9
SSDEEP 12288:QjgQluXGUMxL/qJBVLdBGZ+HrEMS+l48ZIWrkbf:Qjg1u/qTVLdBGZ+LFr4
TLSH
T1D2B41A05F39685E3D8270A70496EF7BF5A2CBA11F9609E6AFB0CCD491F72A617230714
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyA RegOpenKeyW RegQueryValueExA RegQueryValueExW

comctl32

CreateStatusWindowW ImageList_Destroy ImageList_LoadImageW

gdi32

GetDeviceCaps

kernel32

ActivateActCtx CloseHandle CreateActCtxW CreateFileW CreateProcessW DeactivateActCtx DisableThreadLibraryCalls EnumResourceNamesW ExitProcess FindClose FindFirstFileW FindNextFileW FindResourceW GetEnvironmentVariableW GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetTickCount GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MulDiv MultiByteToWideChar ReleaseActCtx SizeofResource WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpW lstrcmpiW

ntdll

_vsnprintf

ole32

CoCreateInstance CoInitialize CoRegisterClassObject CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CreateOleAdviseHolder CreateStreamOnHGlobal OleRegGetUserType PropVariantClear StgCreateStorageEx

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear SafeArrayDestroy SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement LoadRegTypeLib SafeArrayCreateVector

shell32

SHGetFolderPathW ShellAboutW ShellExecuteExW

shlwapi

ord167 PathAppendW PathCreateFromUrlW PathFindExtensionW PathIsURLW SHRegCloseUSKey SHRegEnumUSValueW SHRegOpenUSKeyW SHRegQueryUSValueW UrlApplySchemeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _stricmp _wcsdup _wcsnicmp calloc free fwrite getenv malloc memcmp memcpy memmove realloc strchr strcmp strcspn strlen strrchr toupper wcschr wcslen wcsncmp wcstol

urlmon

CoInternetParseUrl CreateAsyncBindCtx CreateURLMoniker CreateURLMonikerEx2 ReleaseBindInfo

user32

CreatePopupMenu CreateWindowExW DdeCmpStringHandles DdeCreateStringHandleW DdeFreeStringHandle DdeGetData DdeGetLastError DdeInitializeW DdeNameService DdeUninitialize DefWindowProcW DestroyIcon DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClientRect GetDC GetDlgItem GetMenuItemCount GetMenuItemInfoW GetMessageW GetPropW GetSubMenu GetSystemMetrics GetWindowLongW GetWindowTextLengthW GetWindowTextW InsertMenuItemW IsWindowVisible LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW PeekMessageW PostMessageW PostQuitMessage RegisterClassExW ReleaseDC SendMessageW SetFocus SetMenu SetPropW SetWindowLongW SetWindowPos ShowWindow TranslateMessage UnregisterClassW

Name

.text

Size

192KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

104KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

138B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a4b09b229335e55ffddad4aada40cfa1aeec4dcc02fc2ec7de8f9bdb3a1289ac

advapi32

comctl32

gdi32

kernel32

ntdll

ole32

oleaut32

shell32

shlwapi

ucrtbase

urlmon

user32

generic