7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1

Sharing

Copy URL Twitter E-mail

General

Target
7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1
Size 415KB
Sample260809-1z4hjazthy
SHA256 7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1
MD5 c26b5dac02757d3d8cb228177af7764f
SHA1 85e691be84991ef21b99bd5f3dc8e7cf767aab04
SHA512 6f2c2cea32e80eebaa33b7806920c773a1140e98771efacb3a5d158296de15da4e3bda83c17369a223740ec1210f1a52696bd0ff1ecab8f742f6097aeead1a9c
SSDEEP 6144:OoEM2gpj4IXUP66cbfJh4wK4cmbT/IgdSi8XdBLf:OoPaIXkKbflK4cmbv8
TLSH
T132947C16FBB610E9D873C0388663B227FA713C094B745EE75754595A6F237E09E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1

File Explorer

7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1

.exe 415KB

7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1

IMPHASH ca5a0872f429f0a6f1e7b1dff745a588
SHA256 7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1
MD5 c26b5dac02757d3d8cb228177af7764f
SHA1 85e691be84991ef21b99bd5f3dc8e7cf767aab04
SHA512 6f2c2cea32e80eebaa33b7806920c773a1140e98771efacb3a5d158296de15da4e3bda83c17369a223740ec1210f1a52696bd0ff1ecab8f742f6097aeead1a9c
SSDEEP 6144:OoEM2gpj4IXUP66cbfJh4wK4cmbT/IgdSi8XdBLf:OoPaIXkKbflK4cmbv8
TLSH
T132947C16FBB610E9D873C0388663B227FA713C094B745EE75754595A6F237E09E3AB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostMessageA SendMessageA DispatchMessageW TranslateMessage PostQuitMessage RegisterClassExW CreateWindowExW IsWindow DestroyWindow ShowWindow MoveWindow SetWindowPos OpenClipboard CloseClipboard SetClipboardData EmptyClipboard PostMessageW GetMessageW DefWindowProcW SetFocus SetTimer KillTimer CreatePopupMenu EnableWindow GetSystemMetrics UpdateWindow BeginPaint EndPaint InvalidateRect SetWindowTextW GetWindowTextW GetWindowTextLengthW GetParent ClientToScreen SetForegroundWindow TrackPopupMenu AppendMenuW DestroyMenu wsprintfW GetDlgItemTextW SetDlgItemTextW GetDlgItemInt GetDlgItem EndDialog DialogBoxParamW FrameRect DrawTextW SendMessageW LoadImageW DestroyIcon LoadIconW LoadCursorW FillRect MessageBoxW AdjustWindowRect GetWindowRect GetClientRect

gdi32

CreatePen Polygon TextOutW SetTextAlign GetTextExtentPoint32W Ellipse DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject DeleteObject CreateFontW SetTextColor SetBkMode SetBkColor GetStockObject

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

ws2_32

freeaddrinfo getaddrinfo WSACleanup WSAStartup socket setsockopt sendto recvfrom closesocket htons

iphlpapi

GetAdaptersInfo

comctl32

ord410 InitCommonControlsEx ord412 ord413

shell32

SHCreateDirectoryExW ShellExecuteExA

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryOption WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

odbc32

ord75 ord111 ord24 ord9 ord13 ord31 ord141 ord43

comdlg32

GetOpenFileNameW GetSaveFileNameW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

kernel32

GetTimeZoneInformation SetFilePointerEx ReadConsoleW GetConsoleMode GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc HeapFree IsProcessorFeaturePresent GetModuleHandleExW TerminateProcess GetCurrentProcess GetModuleFileNameW GetStdHandle ReadFile RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry InitializeCriticalSectionEx CompareStringW LCMapStringW VirtualProtect SetEnvironmentVariableW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW LoadLibraryExW SetStdHandle GetStringTypeW GetProcessHeap FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetFileSizeEx FlushFileBuffers GetConsoleOutputCP HeapSize SetEndOfFile GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetModuleHandleW CreateProcessW GetExitCodeProcess GetTempPathW FindNextFileW FindFirstFileW FindClose CreateDirectoryW WriteFile DeleteFileW CreateFileW GetTickCount GetLastError DeleteFileA WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc LoadLibraryW GetProcAddress WriteConsoleW FreeEnvironmentStringsW GetModuleFileNameA FreeLibrary GetExitCodeThread CreateThread ExitProcess WaitForSingleObject DeleteCriticalSection GetCurrentDirectoryA GetVolumeInformationA GetSystemInfo GetComputerNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive CloseHandle QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection

Name

.text

Size

260KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7cb33fd63b938317098d93d6b89955dda4510180dd34ea86f7eeb8ee4a07f8c1

user32

gdi32

advapi32

ws2_32

iphlpapi

comctl32

shell32

winhttp

odbc32

comdlg32

bcrypt

kernel32

generic