d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280

Sharing

Copy URL Twitter E-mail

General

Target
d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280
Size 2.0MB
Sample260810-ee2mjs1ajf
SHA256 d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280
MD5 51ada6e22c7b0ce59327af3467b039dd
SHA1 6ca0ca0910696788fa8beddb537842d7d88b3177
SHA512 8b049b81d88a85d95ddff1fbfd9b1c982f3a482fff7f14431854641d99aa0c1d82f018c4af93bb112e5a12f206fc9c97f764d91624bd4516e80eb0b8b9c4969d
SSDEEP 49152:lbl26oIFqRpZ/AC4RS8MC+wJtq7NGcPBKcKHth:l526tFqTZ/ACOS8M0q7NG
TLSH
T1F0A5BE12FB82C172E5DE027962BA577E4D3A9428033885D3C7E169B88D305E1773F79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280

File Explorer

d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280

.dll 2.0MB

d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280

IMPHASH dce6f88c9eda0c046020cbadf9e4255f
SHA256 d5ee9a4f10656f9ce6cf793be8277bbbb36b0ea429cca85171ab0cb9459df280
MD5 51ada6e22c7b0ce59327af3467b039dd
SHA1 6ca0ca0910696788fa8beddb537842d7d88b3177
SHA512 8b049b81d88a85d95ddff1fbfd9b1c982f3a482fff7f14431854641d99aa0c1d82f018c4af93bb112e5a12f206fc9c97f764d91624bd4516e80eb0b8b9c4969d
SSDEEP 49152:lbl26oIFqRpZ/AC4RS8MC+wJtq7NGcPBKcKHth:l526tFqTZ/ACOS8M0q7NG
TLSH
T1F0A5BE12FB82C172E5DE027962BA577E4D3A9428033885D3C7E169B88D305E1773F79A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

221618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetVersionExW GetTickCount GetTempPathW GetLongPathNameW DeleteFileW GetFileAttributesW CreateFileW GetTempFileNameW CopyFileW WriteFile GetExitCodeProcess GetLastError GetFileSize ReadFile FindClose lstrcpyW GetFileAttributesExW FindFirstFileW FindNextFileW MoveFileExW DecodePointer HeapReAlloc HeapSize RaiseException InitializeCriticalSectionAndSpinCount MultiByteToWideChar WideCharToMultiByte CreateDirectoryW ReleaseMutex CreateMutexW GetVolumeInformationW Sleep FileTimeToSystemTime GlobalAlloc GlobalFree OpenProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeviceIoControl OutputDebugStringA SetPriorityClass EncodePointer RtlUnwind InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue IsProcessorFeaturePresent LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA GetStringTypeW GetACP CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetConsoleCtrlHandler GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetTimeZoneInformation SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile OutputDebugStringW WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection CreateEventW LoadLibraryW GetSystemDirectoryW GetModuleFileNameW GetPrivateProfileIntW InitializeCriticalSection CreateThread OpenFileMappingW UnmapViewOfFile FlushViewOfFile MapViewOfFile CloseHandle IsBadReadPtr LoadLibraryA GetNativeSystemInfo SetLastError GetProcessHeap HeapFree HeapAlloc GetFullPathNameW GetCurrentDirectoryW SetConsoleMode ReadConsoleInputA TlsFree VirtualProtect VirtualFree VirtualAlloc GetProcAddress FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW SystemTimeToTzSpecificLocalTime GetDriveTypeW FreeLibraryAndExitThread ExitThread SystemTimeToFileTime GetSystemTime GlobalMemoryStatus FlushConsoleInputBuffer FormatMessageA PeekNamedPipe WaitForMultipleObjects ExpandEnvironmentStringsA VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA VerSetConditionMask SleepEx GetFileAttributesExA QueryPerformanceFrequency

advapi32

CryptAcquireContextA CryptSignHashA CryptEnumProvidersA DuplicateTokenEx SetSecurityDescriptorDacl InitializeSecurityDescriptor RegOpenKeyW RegEnumKeyW RegCreateKeyExW RegQueryValueExW OpenProcessToken ImpersonateLoggedOnUser RevertToSelf DeregisterEventSource RegisterEventSourceA ReportEventA CryptDestroyHash CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathIsDirectoryW

user32

MessageBoxA GetUserObjectInformationW GetProcessWindowStation LoadStringW wsprintfW

ole32

CoInitialize CoUninitialize CoCreateInstance

iphlpapi

GetAdaptersInfo

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty

wininet

InternetOpenW InternetQueryOptionW InternetSetOptionW InternetReadFile InternetOpenUrlW InternetCloseHandle HttpQueryInfoW

wldap32

ord143 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord301 ord217

ws2_32

WSAIoctl getservbyname gethostbyname getsockname getpeername connect closesocket bind send recv select __WSAFDIsSet socket WSAGetLastError getsockopt htons ntohs setsockopt WSASetLastError WSAStartup WSACleanup getaddrinfo freeaddrinfo accept listen htonl shutdown recvfrom sendto ioctlsocket gethostname

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

385KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

46KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=2, id=261, version=23013,

count=18, id=241, version=40116,

count=198, id=243, version=40116,

count=30, id=242, version=40116,

count=8, id=265, version=24215,

count=20, productName=Unmarked objects (old),

count=621, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=8, id=199, version=41118,

count=26, id=259, version=24123,

count=53, id=261, version=24123,

count=35, id=260, version=24123,

count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=336, id=1, productName=Unmarked objects,

count=54, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,