901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962

Sharing

Copy URL Twitter E-mail

General

Target
901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962
Size 2.0MB
Sample260810-ee2bsa1ajb
SHA256 901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962
MD5 528c3778f899494a02f8f34f07d5ad5d
SHA1 d8ea0ef70689a55e769161bee393a708e7118ac2
SHA512 e445d47067caeaaa37406cd7fce39e9438693e287c6c7dd04552083647561265c03a18249d53d3a6f96923f0d8bc0d7e16731b23f0b0eb0bf68ddcdb7b9fc821
SSDEEP 49152:Bbl26oIFqRpZ/AC4RS8MC+wJtq7NGcPBTcKHth:B526tFqTZ/ACOS8M0q7NG
TLSH
T1ECA5BE12FB82C172E5DE027962BA577E4D3A9528033885D3C7D169B88C305E17B3F79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962

File Explorer

901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962

.dll 2.0MB

901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962

IMPHASH dce6f88c9eda0c046020cbadf9e4255f
SHA256 901bdbb9604fc87f5c2664c51ddb0f28f9414c1f8eb1d5c1c7a199bc88e02962
MD5 528c3778f899494a02f8f34f07d5ad5d
SHA1 d8ea0ef70689a55e769161bee393a708e7118ac2
SHA512 e445d47067caeaaa37406cd7fce39e9438693e287c6c7dd04552083647561265c03a18249d53d3a6f96923f0d8bc0d7e16731b23f0b0eb0bf68ddcdb7b9fc821
SSDEEP 49152:Bbl26oIFqRpZ/AC4RS8MC+wJtq7NGcPBTcKHth:B526tFqTZ/ACOS8M0q7NG
TLSH
T1ECA5BE12FB82C172E5DE027962BA577E4D3A9528033885D3C7D169B88C305E17B3F79A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

221618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetVersionExW GetTickCount GetTempPathW GetLongPathNameW DeleteFileW GetFileAttributesW CreateFileW GetTempFileNameW CopyFileW WriteFile GetExitCodeProcess GetLastError GetFileSize ReadFile FindClose lstrcpyW GetFileAttributesExW FindFirstFileW FindNextFileW MoveFileExW DecodePointer HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount MultiByteToWideChar WideCharToMultiByte CreateDirectoryW ReleaseMutex CreateMutexW GetVolumeInformationW Sleep FileTimeToSystemTime GlobalAlloc GlobalFree OpenProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeviceIoControl OutputDebugStringA SetPriorityClass EncodePointer RtlUnwind InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue IsProcessorFeaturePresent LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStringTypeW GetACP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile OutputDebugStringW WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateEventW LoadLibraryW GetSystemDirectoryW GetModuleFileNameW GetPrivateProfileIntW InitializeCriticalSection CreateThread OpenFileMappingW UnmapViewOfFile FlushViewOfFile MapViewOfFile CloseHandle IsBadReadPtr LoadLibraryA GetNativeSystemInfo SetLastError GetProcessHeap HeapFree HeapAlloc GetFullPathNameW GetCurrentDirectoryW SetConsoleMode ReadConsoleInputA TlsFree VirtualProtect VirtualFree VirtualAlloc GetProcAddress FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread SystemTimeToFileTime GetSystemTime GlobalMemoryStatus FlushConsoleInputBuffer FormatMessageA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA VerSetConditionMask SleepEx GetFileAttributesExA QueryPerformanceFrequency

advapi32

CryptAcquireContextA CryptSignHashA CryptEnumProvidersA DuplicateTokenEx SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyW RegEnumKeyW RegCreateKeyExW RegQueryValueExW OpenProcessToken ImpersonateLoggedOnUser RevertToSelf DeregisterEventSource RegisterEventSourceA ReportEventA CryptDestroyHash CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathIsDirectoryW

user32

MessageBoxA GetUserObjectInformationW GetProcessWindowStation LoadStringW wsprintfW

ole32

CoInitialize CoUninitialize CoCreateInstance

iphlpapi

GetAdaptersInfo

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

wininet

InternetOpenW InternetQueryOptionW InternetSetOptionW InternetReadFile InternetOpenUrlW InternetCloseHandle HttpQueryInfoW

wldap32

ord143 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord217

ws2_32

WSAIoctl getservbyname gethostbyname getsockname getpeername connect closesocket bind send recv select __WSAFDIsSet socket WSAGetLastError getsockopt htons ntohs setsockopt WSASetLastError WSAStartup WSACleanup getaddrinfo freeaddrinfo accept listen htonl shutdown recvfrom sendto ioctlsocket gethostname

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

385KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

70KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=261, version=23013,

count=18, id=241, version=40116,

count=198, id=243, version=40116,

count=30, id=242, version=40116,

count=8, id=265, version=24215,

count=20, productName=Unmarked objects (old),

count=621, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=199, version=41118,

count=26, id=259, version=24123,

count=53, id=261, version=24123,

count=35, id=260, version=24123,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=336, id=1, productName=Unmarked objects,

count=54, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,