a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464

Sharing

Copy URL Twitter E-mail

General

Target
a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464
Size 316KB
Sample260809-1n7e2sweka
SHA256 a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464
MD5 76ed75d97442ab39e423eb6476ebd5ab
SHA1 4f903c18d298d92e2ea0f670d73cfba2319dcf5f
SHA512 9e2c64cc00e4bb03016cf5132b5bf61080944dbd4785f2ed0e48c7ef039059694beac4957596f37da9d7fdbca7769da359bbd0506a350062ed67bab4dae6183d
SSDEEP 3072:t2PrE7vOuiwtDU0kUSE/4hsHFqGqdcsAghV0eRVRxazm6Of+ESRwfdft+K9KXEGR:8oquiwtDUvfoMoFsg
TLSH
T13564F698F3E9F166F0BB4B3419B6A7562E357C50AF34D82FEB002E4D1835991DA60723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464

File Explorer

a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464

.dll 316KB

a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464

IMPHASH 35fbfdf8fc7fca836b34f260c5e3eb1b
SHA256 a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464
MD5 76ed75d97442ab39e423eb6476ebd5ab
SHA1 4f903c18d298d92e2ea0f670d73cfba2319dcf5f
SHA512 9e2c64cc00e4bb03016cf5132b5bf61080944dbd4785f2ed0e48c7ef039059694beac4957596f37da9d7fdbca7769da359bbd0506a350062ed67bab4dae6183d
SSDEEP 3072:t2PrE7vOuiwtDU0kUSE/4hsHFqGqdcsAghV0eRVRxazm6Of+ESRwfdft+K9KXEGR:8oquiwtDUvfoMoFsg
TLSH
T13564F698F3E9F166F0BB4B3419B6A7562E357C50AF34D82FEB002E4D1835991DA60723
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

68064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueW

comctl32

PropertySheetW

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleA GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID

oleaut32

SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayPutElement SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen SystemTimeToVariantTime VarBoolFromCy VarBoolFromDate VarBoolFromDec VarBoolFromI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromI8 VarBoolFromR4 VarBoolFromR8 VarBoolFromStr VarBoolFromUI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromUI8 VarBstrFromBool VarBstrFromCy VarBstrFromDate VarBstrFromDec VarBstrFromI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromR4 VarBstrFromR8 VarBstrFromUI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromUI8 VarCyFromBool VarCyFromDate VarCyFromDec VarCyFromI1 VarCyFromI2 VarCyFromI4 VarCyFromI8 VarCyFromR4 VarCyFromR8 VarCyFromStr VarCyFromUI1 VarCyFromUI2 VarCyFromUI4 VarCyFromUI8 VarDateFromBool VarDateFromCy VarDateFromDec VarDateFromI1 VarDateFromI2 VarDateFromI4 VarDateFromI8 VarDateFromR4 VarDateFromR8 VarDateFromStr VarDateFromUI1 VarDateFromUI2 VarDateFromUI4 VarDateFromUI8 VarDecFromI8 VarI1FromBool VarI1FromCy VarI1FromDate VarI1FromDec VarI1FromI2 VarI1FromI4 VarI1FromI8 VarI1FromR4 VarI1FromR8 VarI1FromStr VarI1FromUI1 VarI1FromUI2 VarI1FromUI4 VarI1FromUI8 VarI2FromBool VarI2FromCy VarI2FromDate VarI2FromDec VarI2FromI1 VarI2FromI4 VarI2FromI8 VarI2FromR4 VarI2FromR8 VarI2FromStr VarI2FromUI1 VarI2FromUI2 VarI2FromUI4 VarI2FromUI8 VarI4FromBool VarI4FromCy VarI4FromDate VarI4FromDec VarI4FromI1 VarI4FromI2 VarI4FromI8 VarI4FromR4 VarI4FromR8 VarI4FromStr VarI4FromUI1 VarI4FromUI2 VarI4FromUI4 VarI4FromUI8 VarI8FromStr VarR4FromBool VarR4FromCy VarR4FromDate VarR4FromDec VarR4FromI1 VarR4FromI2 VarR4FromI4 VarR4FromI8 VarR4FromR8 VarR4FromStr VarR4FromUI1 VarR4FromUI2 VarR4FromUI4 VarR4FromUI8 VarR8FromBool VarR8FromCy VarR8FromDate VarR8FromDec VarR8FromI1 VarR8FromI2 VarR8FromI4 VarR8FromI8 VarR8FromR4 VarR8FromStr VarR8FromUI1 VarR8FromUI2 VarR8FromUI4 VarR8FromUI8 VarUI1FromBool VarUI1FromCy VarUI1FromDate VarUI1FromDec VarUI1FromI1 VarUI1FromI2 VarUI1FromI4 VarUI1FromI8 VarUI1FromR4 VarUI1FromR8 VarUI1FromStr VarUI1FromUI2 VarUI1FromUI4 VarUI1FromUI8 VarUI2FromBool VarUI2FromCy VarUI2FromDate VarUI2FromDec VarUI2FromI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromI8 VarUI2FromR4 VarUI2FromR8 VarUI2FromStr VarUI2FromUI1 VarUI2FromUI4 VarUI2FromUI8 VarUI4FromBool VarUI4FromCy VarUI4FromDate VarUI4FromDec VarUI4FromI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromI8 VarUI4FromR4 VarUI4FromR8 VarUI4FromStr VarUI4FromUI1 VarUI4FromUI2 VarUI4FromUI8 VarUI8FromBool VarUI8FromCy VarUI8FromDate VarUI8FromDec VarUI8FromI1 VarUI8FromI2 VarUI8FromI8 VarUI8FromR4 VarUI8FromR8 VarUI8FromStr VarUI8FromUI1 VarUI8FromUI2 VarUI8FromUI4 VariantChangeType VariantClear VariantCopy VariantInit VariantTimeToSystemTime

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswscanf _strdup _wcsicmp bsearch free fwrite getenv memcpy memmove strchr strcmp strcpy strcspn strlen wcschr wcsstr

user32

CharLowerW EnableWindow GetDlgItem GetParent GetWindowRect LoadStringW MessageBoxA MessageBoxW SendMessageA SendMessageW SetWindowLongW wsprintfW

Name

.text

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

40KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

112KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a70168972a49dca643a43fe1b2437fda1ca508767a18efd6f65a54cdf0c30464

advapi32

comctl32

kernel32

ntdll

ole32

oleaut32

ucrtbase

user32

generic