2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405

Sharing

Copy URL Twitter E-mail

General

Target
2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405
Size 5.8MB
Sample260809-xh22latfnd
SHA256 2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405
MD5 a30851c7e6f2d61e368cbc64635a8f14
SHA1 ff8d7d7a6c746ed8226c06e9b8902c7a17b16646
SHA512 a37884bbd410eeddd981e82115e9a0e403ed2c5c59940fdc8be53b0fffb23e5b1bbdd7fb156a0f6e6f9d75113ae362359e000f83600615344d999428b50e1185
SSDEEP 98304:p9uAlmkaqLirStWlYJIrLeuRp1J1rrbewkp0yaRbYPOmbBYQrGY6I0U:plwVmJIr/3J1vKwE0LRbYF9r5ZP
TLSH
T14756222335D76D79E011E7788BC38EADF51BBFD0C5C7093B5289D9050F8A7502EAA1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405

File Explorer

2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405

.dll 5.8MB

2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405

IMPHASH 96b72badad506c77214e9f19a973f94e
SHA256 2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405
MD5 a30851c7e6f2d61e368cbc64635a8f14
SHA1 ff8d7d7a6c746ed8226c06e9b8902c7a17b16646
SHA512 a37884bbd410eeddd981e82115e9a0e403ed2c5c59940fdc8be53b0fffb23e5b1bbdd7fb156a0f6e6f9d75113ae362359e000f83600615344d999428b50e1185
SSDEEP 98304:p9uAlmkaqLirStWlYJIrLeuRp1J1rrbewkp0yaRbYPOmbBYQrGY6I0U:plwVmJIr/3J1vKwE0LRbYF9r5ZP
TLSH
T14756222335D76D79E011E7788BC38EADF51BBFD0C5C7093B5289D9050F8A7502EAA1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10903450

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetVolumeInformationW GetSystemTimeAsFileTime FileTimeToLocalFileTime FileTimeToSystemTime ResetEvent CreateThread SetEvent Sleep CreateEventW SetThreadPriority VirtualQuery WideCharToMultiByte CopyFileW SetCurrentDirectoryW GetCurrentDirectoryW GetSystemInfo DeleteFileW GlobalFlags GetFileAttributesExW MultiByteToWideChar GetSystemDirectoryW GetVersionExW WriteConsoleW GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation LCMapStringW GetFileAttributesW WaitForSingleObject FindClose GetModuleFileNameW TerminateProcess FindNextFileW GetCommandLineW SetLastError FindFirstFileW ReadFile FreeLibrary GetTickCount ExitProcess FreeResource GetCurrentThreadId GlobalReAlloc MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc GlobalSize ReadProcessMemory WriteProcessMemory IsDebuggerPresent FindResourceW LoadResource LockResource SizeofResource TryEnterCriticalSection InitializeCriticalSection CloseHandle SetWaitableTimer CreateWaitableTimerW GetProcessHandleCount GetCurrentProcess GetCurrentProcessId GetModuleHandleW GetCurrentThread GetModuleHandleExW GetProcAddress LoadLibraryW GetProcessHeap DeleteCriticalSection DecodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency HeapQueryInformation FreeLibraryAndExitThread ExitThread GetCommandLineA InterlockedFlushSList RtlPcToFileHeader RtlUnwindEx OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx GetTempFileNameW GetProfileIntW GetTempPathW SearchPathW HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize GetWindowsDirectoryW SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx FindResourceExW VerifyVersionInfoW VerSetConditionMask lstrcmpiW DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile LockFile GetFullPathNameW GetFileSize FlushFileBuffers CreateFileW GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GlobalGetAtomNameW SetErrorMode LocalReAlloc LocalAlloc GlobalHandle TlsFree TlsSetValue TlsGetValue TlsAlloc lstrcpyW GetThreadLocale WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW lstrcmpA FormatMessageW LocalFree CompareStringW QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom EncodePointer OutputDebugStringA LoadLibraryExW VirtualFree VirtualProtect VirtualAlloc FlushInstructionCache SetThreadContext GetThreadContext ResumeThread SuspendThread LeaveCriticalSection InitializeCriticalSectionAndSpinCount EnterCriticalSection HeapFree GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

user32

GetKeyState GetWindow AdjustWindowRectEx MessageBoxW ReleaseDC GetClientRect GetWindowDC SetCursor GetSystemMetrics SetParent ShowWindow InvalidateRect EnableWindow SendMessageW MsgWaitForMultipleObjects DispatchMessageW GetWindowRect LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW SetPropW RegisterClassW SetTimer MoveWindow TranslateMessage GetMessageW PeekMessageW UnregisterClassW GetDC GetClassInfoW DestroyIcon SetWindowLongW IsZoomed SetRect GetWindowLongW GetSystemMenu CallWindowProcW GetFocus IsWindowVisible SetWindowPos SetWindowLongPtrW SetWindowRgn FillRect ScreenToClient RegisterWindowMessageW GetMessagePos GetMessageTime GetClassInfoExW IsMenu GetWindowPlacement SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetDlgItem GetMenuItemID GetForegroundWindow BeginPaint EndPaint ValidateRect ScrollWindow ShowScrollBar GetWindowTextW GetWindowTextLengthW MapWindowPoints EqualRect GetClassLongPtrW GetLastActivePopup SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx SetScrollInfo GetScrollInfo GetMenuStringW GetMenuState RemoveMenu DrawTextW DrawTextExW GrayStringW TabbedTextOutW CheckDlgButton SetWindowTextW IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadMenuW GetKeyNameTextW MapVirtualKeyW PostQuitMessage RegisterClipboardFormatW SetWindowContextHelpId MapDialogRect ShowOwnedPopups CharNextW CreateDialogIndirectParamW EndDialog DrawFocusRect NotifyWinEvent SendDlgItemMessageA SetRectEmpty GetMenuItemInfoW InflateRect SystemParametersInfoW MonitorFromPoint GetSysColorBrush RealChildWindowFromPoint GetAsyncKeyState PostThreadMessageW CopyAcceleratorTableW InvalidateRgn GetNextDlgGroupItem CharUpperW TrackMouseEvent BringWindowToTop LoadAcceleratorsW InsertMenuItemW UnpackDDElParam ReuseDDElParam SetLayeredWindowAttributes EnumDisplayMonitors DrawStateW WaitMessage ToUnicodeEx GetKeyboardLayout GetKeyboardState LockWindowUpdate SetClassLongPtrW DrawEdge DrawFrameControl DrawIconEx UnionRect GetIconInfo GetMenuDefaultItem EnableScrollBar HideCaret InvertRect SetCursorPos CopyIcon FrameRect CharUpperBuffW UpdateLayeredWindow SetMenuDefaultItem IsClipboardFormatAvailable DrawMenuBar DefFrameProcW DefMDIChildProcW TranslateMDISysAccel IsCharLowerW MapVirtualKeyExW SubtractRect GetUpdateRect GetDoubleClickTime GetComboBoxInfo DestroyCursor GetWindowRgn MessageBeep WindowFromPoint GetScrollPos DrawIcon OffsetRect GetCapture RedrawWindow GetScrollRange CopyRect GetDlgCtrlID ClientToScreen IsChild GetTopWindow GetSysColor IsWindowEnabled SetMenu WinHelpW LoadBitmapW IsRectEmpty IntersectRect SetFocus GetClassNameW SetCapture SetScrollRange KillTimer SetScrollPos PtInRect UpdateWindow ReleaseCapture IsIconic GetNextDlgTabItem IsWindow wsprintfW ModifyMenuW GetMenu GetMenuItemCount DeleteMenu CreatePopupMenu TrackPopupMenu GetSubMenu DestroyAcceleratorTable CreateAcceleratorTableW DestroyMenu TranslateAcceleratorW InsertMenuW CheckMenuItem AppendMenuW EnableMenuItem CreateMenu GetCursorPos GetWindowThreadProcessId MonitorFromWindow SetActiveWindow OpenClipboard GetMonitorInfoW CloseClipboard EmptyClipboard SetClipboardData EnumDisplaySettingsW SetForegroundWindow CopyImage DefWindowProcW PostMessageW DestroyWindow GetPropW CreateWindowExW RemovePropW GetWindowLongPtrW LoadStringW GetActiveWindow

gdi32

CreateHatchBrush GetWindowOrgEx CreatePatternBrush GetPixel CreateRectRgn CreateBitmap CombineRgn GetViewportOrgEx PatBlt CreateRoundRectRgn GetTextMetricsW CreatePen Rectangle Ellipse CreateSolidBrush CreateEllipticRgn RoundRect GetTextExtentPoint32W CreateFontIndirectW BitBlt CreateCompatibleBitmap SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GdiAlphaBlend RealizePalette GetStockObject GetDeviceCaps GetSystemPaletteEntries SetPixel CreatePalette GetObjectW SetStretchBltMode DeleteObject DeleteDC SetBkColor SetTextColor CopyMetaFileW CreateDCW Escape GetClipBox GetObjectType GetViewportExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign GetWindowExtEx SelectPalette StretchBlt ExcludeClipRect SetPixelV GetTextFaceW PtInRegion GetBoundsRect FrameRgn FillRgn SetPaletteEntries ExtFloodFill LPtoDP GetPaletteEntries GetNearestPaletteIndex EnumFontFamiliesExW Polyline Polygon CreatePolygonRgn OffsetRgn GetTextCharsetInfo EnumFontFamiliesW CreateDIBitmap GetRgnBox DPtoLP SetRectRgn GetMapMode GetTextColor GetBkColor CreateRectRgnIndirect ScaleWindowExtEx ScaleViewportExtEx OffsetWindowOrgEx OffsetViewportOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW MoveToEx

advapi32

RegDeleteValueW RegEnumKeyW RegEnumKeyExW RegEnumValueW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueW RegCreateKeyExW RegSetValueExW

shell32

DragQueryFileW Shell_NotifyIconW ShellExecuteW DragFinish SHAppBarMessage SHGetPathFromIDListW SHGetSpecialFolderLocation SHBrowseForFolderW SHGetDesktopFolder SHGetFileInfoW

ole32

CoFreeUnusedLibraries OleInitialize OleUninitialize CoInitialize CoDisconnectObject CoGetClassObject CoRevokeClassObject CreateStreamOnHGlobal OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CreateILockBytesOnHGlobal DoDragDrop CoCreateGuid OleLockRunning CoLockObjectExternal RegisterDragDrop RevokeDragDrop OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitializeEx CoCreateInstance CLSIDFromProgID CLSIDFromString OleGetClipboard

oleaut32

SafeArrayDestroy SysStringLen VarBstrFromDate SysAllocStringLen SystemTimeToVariantTime VariantTimeToSystemTime VariantInit SysFreeString LoadTypeLi VariantClear VariantChangeType VariantCopy SysAllocString OleCreateFontIndirect

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked InitCommonControlsEx

libcurl

curl_slist_free_all curl_easy_pause curl_easy_init curl_easy_cleanup

msimg32

AlphaBlend TransparentBlt

shlwapi

PathIsUNCW StrFormatKBSizeW PathRemoveFileSpecW PathStripToRootW PathFindFileNameW PathFindExtensionW

uxtheme

OpenThemeData GetThemeSysColor IsThemeBackgroundPartiallyTransparent GetCurrentThemeName GetThemeColor DrawThemeParentBackground DrawThemeText GetWindowTheme IsAppThemed GetThemePartSize DrawThemeBackground CloseThemeData

oledlg

OleUIBusyW

gdiplus

GdipBitmapLockBits GdipFree GdipGetImagePixelFormat GdipSetInterpolationMode GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipDrawImageI GdiplusStartup GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdiplusShutdown GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetImageGraphicsContext GdipSetCompositingMode GdipGetImagePalette GdipDeleteGraphics GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI

ws2_32

WSACleanup

oleacc

CreateStdAccessibleObject AccessibleObjectFromWindow LresultFromObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

Name

.text

Size

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.42'

Size

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.|y8

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.z))

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

133KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2a7c9c506a78ed8fd2127ad11bf74bf7feb18ff9987ab65bf257e437203b4405

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

libcurl

msimg32

shlwapi

uxtheme

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

winspool.drv

generic