c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98

Sharing

Copy URL Twitter E-mail

General

Target
c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98
Size 624KB
Sample260811-mpql2a1ejf
SHA256 c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98
MD5 75ac4bc5bbedac705fdb72416868c355
SHA1 2298da572b48dfd7a60a6d6d67b2bd9f4648ded9
SHA512 e5e0618fd8b5f719432bdb148a42def7c1effc0281e5588744c22ef2bc0c6506a036d1b252bf709df7b0abd3f2461f974d105a79e6baae69e110e7d5e131bad3
SSDEEP 12288:AjTIJ03Z1unyKae2YBoRa1RMYz8+Bg1inVnNpHf0fPppocihF:AjTe03ZQypYekRlPgQVnNpHf0fPHho
TLSH
T14FD45A06B7E440A5D0BBC1398A53562AF7B2BC150B708BDB4390A66F1F377A15F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98

File Explorer

c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98

.dll 624KB

c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98

IMPHASH 5358c7014b2b1e7bd91799e7cfb5c67d
SHA256 c2b2879b9672873cac59283a0dbe1d42a79345284ac4d4527692f30c89cdff98
MD5 75ac4bc5bbedac705fdb72416868c355
SHA1 2298da572b48dfd7a60a6d6d67b2bd9f4648ded9
SHA512 e5e0618fd8b5f719432bdb148a42def7c1effc0281e5588744c22ef2bc0c6506a036d1b252bf709df7b0abd3f2461f974d105a79e6baae69e110e7d5e131bad3
SSDEEP 12288:AjTIJ03Z1unyKae2YBoRa1RMYz8+Bg1inVnNpHf0fPppocihF:AjTe03ZQypYekRlPgQVnNpHf0fPHho
TLSH
T14FD45A06B7E440A5D0BBC1398A53562AF7B2BC150B708BDB4390A66F1F377A15F3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\edg\6.0.8\MonSafe\MonSafe\x64\Release\BoxFsSec64.pdb

kernel32

GlobalSize RtlUnwind CreateEventW SuspendThread ResumeThread GetPrivateProfileIntW GlobalAlloc GlobalUnlock GlobalFree GetLastError SizeofResource LockResource LoadResource FindResourceW GlobalLock GetCurrentProcessId GetModuleFileNameW OutputDebugStringW GlobalAddAtomW EncodePointer GetSystemDirectoryW GlobalFindAtomW CompareStringW EnterCriticalSection LeaveCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc SetLastError GetDriveTypeW InitializeCriticalSection DeleteCriticalSection VirtualProtect CreateProcessW CreateFileW CreateToolhelp32Snapshot Process32FirstW CloseHandle Process32NextW Sleep GetCurrentThread GetModuleHandleW LoadLibraryW GetProcAddress GetPrivateProfileStringW WritePrivateProfileStringW GetTempPathW GetEnvironmentVariableW GetComputerNameW HeapFree InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer GetProcessHeap MulDiv GetLocalTime MultiByteToWideChar CreateProcessA GetCurrentProcess CreateDirectoryW CopyFileW WideCharToMultiByte GetACP OutputDebugStringA GetModuleHandleExW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW LocalFree FormatMessageW GetCurrentThreadId GetVersionExW FreeLibrary LoadLibraryExW GlobalDeleteAtom WriteConsoleW SetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA EnumSystemLocalesW IsValidLocale GetFileType GetStdHandle GetTimeZoneInformation GetModuleFileNameA HeapQueryInformation GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetSystemInfo GetCommandLineW SetFilePointerEx GetProcessId GetNativeSystemInfo IsWow64Process WriteProcessMemory ReadProcessMemory VirtualAllocEx OpenProcess ExitProcess LoadLibraryExA VirtualQueryEx VirtualProtectEx VirtualQuery VirtualFree VirtualAlloc FlushInstructionCache SetThreadContext GetThreadContext GetCPInfo LCMapStringW SwitchToThread GetStringTypeW lstrcmpA lstrcmpW GlobalHandle LocalAlloc LocalReAlloc SetErrorMode FileTimeToSystemTime GetCurrentDirectoryW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetUserDefaultLCID SystemTimeToTzSpecificLocalTime GetFileAttributesExW FileTimeToLocalFileTime WriteFile ReadFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindFirstFileW FindClose DeleteFileW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW

user32

GetSubMenu GetMenuItemID GetMenuItemCount PostMessageW PostQuitMessage SendMessageW CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetMessageW TranslateMessage DispatchMessageW PeekMessageW IsWindowVisible GetActiveWindow GetKeyState ValidateRect SetCursor EnableWindow IsWindowEnabled GetWindowLongW GetLastActivePopup GetScrollPos GetWindow RegisterWindowMessageW GetMessagePos GetMessageTime DefWindowProcW CallWindowProcW RegisterClassW GetClassInfoW GetClassInfoExW IsMenu OpenClipboard SetClipboardData GetClipboardData EmptyClipboard EnumClipboardFormats IsClipboardFormatAvailable GetPriorityClipboardFormat CloseClipboard RegisterClipboardFormatW SetWindowPos BeginDeferWindowPos DeferWindowPos EndDeferWindowPos IsIconic GetDlgItem GetDlgCtrlID GetCapture GetForegroundWindow GetWindowTextW GetParent GetCursorPos WindowFromPoint GetWindowThreadProcessId CallNextHookEx SetWindowsHookExW UnhookWindowsHookEx WindowFromDC IsWindow GetDesktopWindow GetAncestor EnumWindows GetFocus ShowWindow GetWindowRect DestroyWindow CreateWindowExA CreateWindowExW UnregisterClassW DrawTextW MessageBoxW InternalGetWindowText CreateDialogParamW CreateDialogIndirectParamW EndDialog GetClientRect SetRectEmpty OffsetRect GetMenu DestroyMenu CharUpperW TabbedTextOutW GrayStringW DrawTextExW InvalidateRect KillTimer SetTimer RealChildWindowFromPoint ClientToScreen LoadCursorW GetSysColorBrush ReleaseDC GetDC GetSystemMetrics SetWindowTextW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx RemovePropW GetPropW SetPropW RedrawWindow EndPaint BeginPaint SetForegroundWindow UpdateWindow SetMenu

gdi32

BitBlt CreateCompatibleBitmap SelectObject GetObjectW DeleteDC ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetMapMode RectVisible PtVisible DeleteObject GetClipBox Escape CreateBitmap EndPage StartPage EndDoc StartDocW RestoreDC SetBkColor SetTextColor SetBkMode SaveDC CreateFontIndirectW GetDeviceCaps StretchBlt DeleteEnhMetaFile SetEnhMetaFileBits GetDIBits GetStockObject GetEnhMetaFileBits CreateCompatibleDC

comdlg32

GetSaveFileNameW GetSaveFileNameA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegEnumKeyW RegQueryValueW RegEnumValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

ShellExecuteW DragQueryFileW

shlwapi

PathIsNetworkPathW StrStrIW StrStrIA PathIsDirectoryW PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathFileExistsW

ole32

CoUninitialize CoCreateGuid CoTaskMemFree CoCreateInstance DoDragDrop CoInitialize

ws2_32

inet_ntoa connect inet_addr

psapi

GetProcessImageFileNameW GetModuleFileNameExW

fltlib

FilterSendMessage FilterConnectCommunicationPort

iphlpapi

GetAdaptersInfo

Name

.text

Size

392KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

MonClipS

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=187, id=243, version=40116,

count=26, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=4, id=261, version=27048,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=135, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=821, id=1, productName=Unmarked objects,

count=4, id=199, version=41118,

count=33, id=260, version=26706,

count=9, id=259, version=26706,

count=159, id=261, version=26706,

count=61, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,