5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

Sharing

Copy URL Twitter E-mail

General

Target
5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf
Size 428KB
Sample260811-2ssccstejf
SHA256 5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf
MD5 ed82f0bbcc259c2a3c0fa7c931a819a6
SHA1 2958bc34d06a016bf3c34422c1358ab9991f4aed
SHA512 72c20c39fcbb1858fb1c6c7e55f7d6ca1cb151e2dde6a02036335e3175cf56d52ae33a1d8f6bda19f1b80748e2aaf797d33e4f9c928f89f25f58f869688374d8
SSDEEP 12288:VpXaUQVwH5irGw7J+emP7pJh+boNkyS6:VpXafdGws7Dh+r8
TLSH
T13A943B13F7D201ECF4BBC6709A7B9632A9337C505934FA1E15588A252EB1E109F38F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

File Explorer

5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

.exe 428KB

5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

IMPHASH 98c73c002d810b384c98c30b84f05989
SHA256 5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf
MD5 ed82f0bbcc259c2a3c0fa7c931a819a6
SHA1 2958bc34d06a016bf3c34422c1358ab9991f4aed
SHA512 72c20c39fcbb1858fb1c6c7e55f7d6ca1cb151e2dde6a02036335e3175cf56d52ae33a1d8f6bda19f1b80748e2aaf797d33e4f9c928f89f25f58f869688374d8
SSDEEP 12288:VpXaUQVwH5irGw7J+emP7pJh+boNkyS6:VpXafdGws7Dh+r8
TLSH
T13A943B13F7D201ECF4BBC6709A7B9632A9337C505934FA1E15588A252EB1E109F38F66
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext CryptSetHashParam CryptSetKeyParam LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCopyTreeW RegCreateKeyExW RegGetValueW RegLoadKeyW RegOpenKeyExW RegQueryValueExW RegUnLoadKeyW StartServiceW

cabinet

FDICopy FDICreate FDIDestroy

comctl32

ImageList_Create ImageList_Destroy ImageList_GetIcon ImageList_GetImageCount ImageList_ReplaceIcon ImageList_SetOverlayImage InitCommonControlsEx

comdlg32

GetSaveFileNameW

crypt32

CryptBinaryToStringW CryptStringToBinaryW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateFontW CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextExtentPoint32W SelectObject SetBkColor SetBkMode SetTextColor

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateSemaphoreA DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitThread FindClose FindFirstFileW FindNextFileW FreeLibrary GetCPInfo GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessAffinityMask GetProcessHeap GetShortPathNameW GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocalReAlloc MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrcatW lstrcmpW lstrcmpiW lstrcpynW lstrlenW

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _close _commode _endthreadex _errno _fileno _fmode _initterm _lseek _open _read _setjmp _setmode _strcmpi _strnicmp _strdup _vscprintf _vsnprintf _vsnwprintf _wcsicmp _wcsicmp _wcsnicmp _wcsnicmp _wopen _write _write _wtoi atexit abort calloc exit fflush fprintf free longjmp malloc memchr memcmp memcpy memmove memset qsort realloc setvbuf signal strlen strncmp strstr swprintf_s swscanf_s towlower vfprintf wcschr wcscmp wcscpy wcscpy_s wcslen wcsncmp wcsrchr wcsstr wcstol

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

setupapi

CM_Disable_DevNode CM_Enable_DevNode CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key CM_Reenumerate_DevNode SetupCloseInfFile SetupCopyOEMInfW SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiDestroyClassImageList SetupDiDestroyDeviceInfoList SetupDiDestroyDriverInfoList SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupDiGetClassDescriptionW SetupDiGetClassDevsW SetupDiGetClassImageIndex SetupDiGetClassImageList SetupDiGetDeviceInstallParamsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetINFClassW SetupDiInstallDevice SetupDiLoadDeviceIcon SetupDiOpenDeviceInfoW SetupDiRemoveDevice SetupDiSetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetSelectedDriverW SetupFindFirstLineW SetupGetLineTextW SetupGetStringFieldW SetupOpenInfFileW SetupUninstallOEMInfW

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW ExtractIconExW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW ShellExecuteW StrStrIW

shlwapi

PathFindExtensionW PathIsDirectoryW PathMatchSpecW SHLoadIndirectString

user32

AppendMenuW BeginPaint CallWindowProcW ChangeWindowMessageFilterEx CloseClipboard CopyImage CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableWindow EndDialog EndPaint EnumChildWindows FillRect FrameRect GetAncestor GetClassNameW GetClientRect GetDC GetDlgCtrlID GetDlgItem GetDlgItemTextW GetMessagePos GetMessageW GetParent GetSysColor GetSysColorBrush GetSystemMetrics GetWindow GetWindowDC GetWindowLongPtrW GetWindowRect GetWindowTextW InflateRect InsertMenuItemW InvalidateRect IsDialogMessageW IsDlgButtonChecked IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW MapWindowPoints MessageBoxW OffsetRect OpenClipboard PostMessageW PostQuitMessage RedrawWindow RegisterClassW RegisterDeviceNotificationW ReleaseDC ScreenToClient SendDlgItemMessageW SendMessageW SetClipboardData SetDlgItemTextW SetForegroundWindow SetProcessDPIAware SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UnregisterDeviceNotification UpdateWindow wsprintfW

uxtheme

SetWindowTheme

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

HttpQueryInfoW InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile

Name

.text

Size

258KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

advapi32

cabinet

comctl32

comdlg32

crypt32

gdi32

iphlpapi

kernel32

msvcrt

ole32

setupapi

shell32

shlwapi

user32

uxtheme

version

wininet

generic