1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8

Sharing

Copy URL Twitter E-mail

General

Target
1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8
Size 3.6MB
Sample260809-lc3kdshg55
SHA256 1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8
MD5 3dd4e8f41ba9e226547a18222868958e
SHA1 ccd79bbdd594af44e708928de4fdce575f5957ec
SHA512 da8915531966f90f7251822914282a2d14b052d297c397ce20e52bd3b5cad2547f0948fff16305213dfc138b104ecd942d3fe4530da31346190d751f232fa1b8
SSDEEP 49152:tEE+tSJPhDoO6KHfJ9fk9gK9bVrfKJeq0f8eH:tKST/JaHbZH
TLSH
T1D1069D03F35586DDE52AC0744711A163ABA3FC861B3572BB67883E616F13EA04F5D38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8

File Explorer

1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8

.exe 3.6MB

1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8

IMPHASH 71a3a6842c4c9db0487a6320b1ad9f10
SHA256 1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8
MD5 3dd4e8f41ba9e226547a18222868958e
SHA1 ccd79bbdd594af44e708928de4fdce575f5957ec
SHA512 da8915531966f90f7251822914282a2d14b052d297c397ce20e52bd3b5cad2547f0948fff16305213dfc138b104ecd942d3fe4530da31346190d751f232fa1b8
SSDEEP 49152:tEE+tSJPhDoO6KHfJ9fk9gK9bVrfKJeq0f8eH:tKST/JaHbZH
TLSH
T1D1069D03F35586DDE52AC0744711A163ABA3FC861B3572BB67883E616F13EA04F5D38A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1509716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

stub.pdb

kernel32

GetModuleHandleA CloseHandle GetModuleFileNameW LoadLibraryExW GetLastError FreeLibrary SetThreadErrorMode GetProcAddress GetModuleHandleExW Sleep FlsSetValue InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx GetDiskFreeSpaceExW WaitForSingleObject GetDriveTypeW SwitchToThread CopyFileExW DeleteFileW SetFileInformationByHandle MultiByteToWideChar AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GlobalLock GlobalUnlock GetCurrentThreadId GlobalSize WideCharToMultiByte GlobalAlloc GlobalFree FormatMessageW GetProcessHeap HeapFree HeapReAlloc LoadLibraryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW HeapAlloc GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx GetModuleHandleW QueryPerformanceCounter CreateThread GetFullPathNameW CreateFileW SetFileTime FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle GetCommandLineW CreateWaitableTimerExW SetWaitableTimer SetFilePointerEx LoadLibraryExA EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader WriteFile GetCommandLineA FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetSystemTimeAsFileTime FlsAlloc InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FlsFree HeapSize FlushFileBuffers QueryPerformanceFrequency FlsGetValue

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

opengl32

wglGetCurrentContext wglCreateContext wglGetCurrentDC wglShareLists wglMakeCurrent wglGetProcAddress wglDeleteContext

shlwapi

AssocQueryStringW

user32

GetClassInfoExW ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW RegisterWindowMessageA DestroyIcon ChangeDisplaySettingsExW SetWindowPlacement ReleaseCapture GetWindowRect GetWindowLongW AdjustWindowRectEx GetKeyboardLayout MapVirtualKeyExW ToUnicodeEx GetClipCursor ClipCursor ShowCursor EnumDisplayMonitors SetCapture IsIconic SendInput SetForegroundWindow SystemParametersInfoA SetTimer SetClipboardData EmptyClipboard GetClipboardData IsClipboardFormatAvailable GetWindowTextW GetWindowTextLengthW PeekMessageW GetForegroundWindow CreateIcon SetCursorPos ClientToScreen CreateIconFromResourceEx ReleaseDC GetActiveWindow GetMonitorInfoW SetCursor LoadCursorW GetCursorPos MonitorFromRect GetWindowPlacement CloseTouchInputHandle GetTouchInputInfo DestroyWindow GetMenu TrackMouseEvent IsProcessDPIAware GetKeyState GetAsyncKeyState SetWindowLongPtrW MonitorFromWindow GetKeyboardState GetDC RegisterTouchWindow DefWindowProcW InvalidateRgn SetWindowPos GetClientRect SetWindowDisplayAffinity SendMessageW GetWindowLongPtrW PostMessageW RedrawWindow CreateWindowExW RegisterClassExW MonitorFromPoint CloseClipboard OpenClipboard MessageBoxW GetSystemMetrics ValidateRect GetClassNameW MapVirtualKeyW FlashWindowEx GetRawInputData RegisterRawInputDevices DispatchMessageW TranslateMessage KillTimer SetWindowTextW GetMessageW ScreenToClient

shell32

ShellExecuteW DragFinish DragQueryFileW SHGetKnownFolderPath SHCreateItemFromParsingName

gdi32

SwapBuffers DescribePixelFormat ChoosePixelFormat GetDeviceCaps CreateRectRgn SetPixelFormat DeleteObject

advapi32

RevertToSelf ImpersonateAnonymousToken RegDeleteTreeW RegCloseKey RegCreateKeyExW RegSetValueExW

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpSetTimeouts WinHttpReadData WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpQueryDataAvailable

ole32

CoTaskMemFree RevokeDragDrop RegisterDragDrop OleInitialize CoCreateInstance CoUninitialize CoInitializeEx

dwmapi

DwmEnableBlurBehindWindow

imm32

ImmSetCandidateWindow ImmAssociateContextEx ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmGetCompositionStringW

ntdll

NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError NtReadFile NtWriteFile

oleaut32

GetErrorInfo SysStringLen SysFreeString

uxtheme

SetWindowTheme

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1e0c5675fe7b65459da12b2ce9e657ba25760497a5d39bd8f7c045fc0ef7d2b8

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

opengl32

shlwapi

user32

shell32

gdi32

advapi32

winhttp

ole32

dwmapi

imm32

ntdll

oleaut32

uxtheme

generic