101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235

Sharing

Copy URL Twitter E-mail

General

Target
101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235
Size 2.3MB
Sample260808-d3vy8sgr8t
SHA256 101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235
MD5 e04e512dab6a1d8cc70374ac228dbf3a
SHA1 0354af623d5bc2d3ad6d0fe0d3e9d180ddaa365e
SHA512 e75158f3fc79eb88a5737497cf1275bc47958f671807622372af348e85bca2c952440a4c80a55c1670e4e4514217e9f497f0386a2fbbff10beaa156bfd619c15
SSDEEP 49152:KB1zz37C7OLRlZm6tV0S/S20Dos+FCjfIyvZwSjSDt:KB1zz7C7KX46D0quos+4j6
TLSH
T133B58E20B561C136F8BB01F2DBBD4DAE952CAE71072814DB93C8186E5AB5CF27B31617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235

File Explorer

101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235

.dll 2.3MB

101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235

IMPHASH 4bcc0f783474e1343e0ab6e3e3e963b1
SHA256 101e0f98e26177646a7be437972e90d04a29c3889578eda230930199ef5eb235
MD5 e04e512dab6a1d8cc70374ac228dbf3a
SHA1 0354af623d5bc2d3ad6d0fe0d3e9d180ddaa365e
SHA512 e75158f3fc79eb88a5737497cf1275bc47958f671807622372af348e85bca2c952440a4c80a55c1670e4e4514217e9f497f0386a2fbbff10beaa156bfd619c15
SSDEEP 49152:KB1zz37C7OLRlZm6tV0S/S20Dos+FCjfIyvZwSjSDt:KB1zz7C7KX46D0quos+4j6
TLSH
T133B58E20B561C136F8BB01F2DBBD4DAE952CAE71072814DB93C8186E5AB5CF27B31617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1335527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\src\_LdsCode\general_use\mg_faiconshelper\Release\BwSystemHelper.pdb

kernel32

EnterCriticalSection InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte CloseHandle GetCurrentProcess CreateProcessW GetStartupInfoW GetTickCount64 FindResourceExW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc K32GetProcessImageFileNameW lstrcpyW lstrcmpiW QueryDosDeviceW LeaveCriticalSection CreateDirectoryW SetConsoleTextAttribute GetConsoleScreenBufferInfo WriteConsoleA GetConsoleMode GetDynamicTimeZoneInformation GetCurrentProcessId WriteFile GetStdHandle GetTickCount CreateThread Sleep CreateMutexW ReleaseMutex WaitForMultipleObjects CreateEventW WaitForSingleObject SetEvent Process32NextW Process32FirstW CreateToolhelp32Snapshot WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW VirtualFreeEx VirtualAllocEx OpenProcess LoadLibraryW GetLogicalDriveStringsW InitializeCriticalSectionEx FreeLibrary WriteConsoleW SetEndOfFile HeapDestroy SetLastError GetLastError RaiseException FindResourceW QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete GetStringTypeW WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime LocalFree EncodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW GetACP VerSetConditionMask MulDiv VerifyVersionInfoW GetCurrentDirectoryW CreateFileW GetFileSize ReadFile GlobalUnlock GlobalLock lstrlenW ExitProcess GetFileAttributesW LocalFileTimeToFileTime SetFilePointer SetFileTime SystemTimeToFileTime FormatMessageW InitializeCriticalSectionAndSpinCount FreeResource GlobalAlloc lstrcmpW GetLocalTime lstrcpynW DeleteFileW FlushFileBuffers UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess CreateFileA FindClose FindFirstFileA FindNextFileA MapViewOfFile UnmapViewOfFile CreateFileMappingA GetSystemWindowsDirectoryW GetVersionExW LoadLibraryExW DeviceIoControl lstrcmpA GetFileType GetModuleHandleA GetFileSizeEx FindNextFileW RtlUnwind InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx GetConsoleOutputCP GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW MoveFileExW GetFullPathNameW SetStdHandle ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW DecodePointer

user32

GetSysColor IntersectRect IsRectEmpty PtInRect SetWindowRgn UpdateLayeredWindow MoveWindow IsWindowEnabled GetWindowRgn CharPrevW DrawTextW FillRect SetRect CreatePopupMenu DestroyMenu EnableMenuItem AppendMenuW TrackPopupMenu CreateCaret GetCaretBlinkTime HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen UpdateWindow ScreenToClient SetWindowTextW GetWindowTextLengthW wsprintfA DrawTextA CreateAcceleratorTableW InvalidateRgn GetGUIThreadInfo SetForegroundWindow GetKeyboardLayout GetParent MapVirtualKeyExW GetProcessWindowStation GetUserObjectInformationW MessageBoxA InflateRect CallWindowProcW GetPropW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW GetCursorPos InvalidateRect GetUpdateRect EndPaint BeginPaint ReleaseCapture SetCapture GetKeyState GetFocus GetActiveWindow SetPropW EnableWindow MapWindowPoints IsZoomed IsIconic MonitorFromPoint MessageBoxW OffsetRect EqualRect SetCursor SetFocus ShowWindow RegisterClassW UnionRect CharNextW SendMessageW MonitorFromWindow ReleaseDC GetDC PostThreadMessageW PeekMessageW GetWindowTextW IsWindowVisible PostQuitMessage DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW GetWindowThreadProcessId FindWindowExW FindWindowW SendMessageTimeoutW GetClientRect SetWindowPos PostMessageW LoadCursorW SetWindowLongW GetWindowLongW GetWindowRect KillTimer SetTimer DestroyWindow IsWindow GetMonitorInfoW LoadImageW DefWindowProcW GetWindow wsprintfW GetKeyNameTextW

gdi32

CreatePatternBrush BitBlt CreateCompatibleBitmap CreateDIBitmap CreateFontIndirectW CreatePen DeleteObject GetStockObject AddFontMemResourceEx RemoveFontMemResourceEx Rectangle RestoreDC SaveDC SelectObject CloseEnhMetaFile CreateEnhMetaFileW GetEnhMetaFileHeader PlayEnhMetaFile GetTextMetricsW GetObjectW SetWindowOrgEx CreateRoundRectRgn CreateRectRgn PtInRegion CreateDIBSection CombineRgn CreatePenIndirect CreateRectRgnIndirect CreateSolidBrush GetCharABCWidthsW GetClipBox GetTextExtentPoint32W LineTo SelectClipRgn ExtSelectClipRgn SetBkColor GetBitmapBits GetTextExtentPointA GdiFlush TextOutW GetDeviceCaps DeleteDC CreateCompatibleDC SetBkMode StretchBlt SetStretchBltMode SetTextColor MoveToEx SetBitmapBits

advapi32

RegCreateKeyExW ReportEventA RegisterEventSourceA DeregisterEventSource RegSetValueExW GetTokenInformation RegQueryValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey OpenProcessToken

shell32

DragQueryFileW ShellExecuteW SHCreateDirectoryExW

ole32

CoCreateGuid CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoInitialize CoUninitialize OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal ReleaseStgMedium OleDuplicateData DoDragDrop

oleaut32

SysAllocStringLen SysStringLen VariantClear VariantInit SysFreeString SysAllocString

shlwapi

PathFileExistsW PathRemoveFileSpecW SHGetValueW PathFindFileNameW PathRemoveExtensionW PathAppendW StrStrIW StrCmpNIW StrTrimA StrStrIA StrCmpIW PathIsDirectoryW PathIsRelativeW PathIsRootW PathCombineW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

gdiplus

GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipSetPenStartCap GdipImageGetFrameDimensionsCount GdipGetPropertyItem GdipSetPenEndCap GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipDrawImageRectI GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipMeasureString GdipGetImageHeight GdipTranslateWorldTransform GdipRotateWorldTransform GdipDrawLine GdipCreatePen2 GdipDeletePen GdipAlloc GdipFree GdipCreatePath GdipDeletePath GdipAddPathLine GdipAddPathArc GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipGetImageWidth GdipSetPenMode GdipSetPenDashStyle GdipLoadImageFromStream GdipLoadImageFromStreamICM GdipCloneImage GdipDisposeImage GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipReleaseDC GdipSetSmoothingMode GdipSetWorldTransform GdipResetWorldTransform GdipDrawRectangleI GdipDrawPath GdipFillRectangleI GdipFillPath GdipDrawImageRectRect GdipDrawImageI

ws2_32

gethostbyname gethostname WSAStartup

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

comctl32

_TrackMouseEvent ord17 InitCommonControlsEx

msimg32

AlphaBlend

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext

generic

count=38, id=259, version=30795,

count=223, id=261, version=30795,

count=3, productName=Unmarked objects (old),

count=21, id=260, version=35211,

count=1, id=261, version=35211,

count=11, id=260, version=35213,

count=21, id=260, version=35207,

count=6, id=265, version=35228,

count=25, id=261, version=35213,

count=1, id=263, version=30795,

count=27, id=259, version=35207,

count=98, id=261, version=35207,

count=46, id=260, version=30795,

count=1, id=262, version=30795,

count=37, id=257, version=30795,

count=526, id=1, productName=Unmarked objects,

count=69, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=151,

count=1, id=258, version=35228,