5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317

Sharing

Copy URL Twitter E-mail

General

Target
5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317
Size 588KB
Sample260813-rymc7a1we1
SHA256 5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317
MD5 dad357a135223ba04e91b3053c9ca9c3
SHA1 87293356d38a1dbf5bf3b466aefe546ce7874e3a
SHA512 f759f5aa4d0d48b73ded7fc62750b9f0fd8e8a76daaff64f4ac2cad06c0398e79ff9c7381fb8a7b10e47e4254e0620cd888844b2fcb92ade4d3440e29ea0a954
SSDEEP 12288:AoLx6At0jTDYesV6Kc/pyRfij4DC1BoJNLYdDyolrtxIAS4ka:Bt039BRCE4DC1BdfjxIAf
TLSH
T1B1D47E27E6A803FCE1BBD1798E569902E7723849077196CB07909D663F27AD04E3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317

File Explorer

5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317

.exe 588KB

5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317

IMPHASH eac64ae7ec2efd3c8196f33238cd43fc
SHA256 5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317
MD5 dad357a135223ba04e91b3053c9ca9c3
SHA1 87293356d38a1dbf5bf3b466aefe546ce7874e3a
SHA512 f759f5aa4d0d48b73ded7fc62750b9f0fd8e8a76daaff64f4ac2cad06c0398e79ff9c7381fb8a7b10e47e4254e0620cd888844b2fcb92ade4d3440e29ea0a954
SSDEEP 12288:AoLx6At0jTDYesV6Kc/pyRfij4DC1BoJNLYdDyolrtxIAS4ka:Bt039BRCE4DC1BdfjxIAf
TLSH
T1B1D47E27E6A803FCE1BBD1798E569902E7723849077196CB07909D663F27AD04E3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

393384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetDesktopWindow GetSystemMetrics OpenClipboard ScreenToClient ReleaseDC IsWindow EmptyClipboard SetClipboardData LoadCursorW GetWindowRect InvalidateRect RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetTimer KillTimer IsClipboardFormatAvailable GetCaretBlinkTime SetWindowLongPtrW GetWindowLongPtrW DefWindowProcW GetKeyState RedrawWindow GetWindowTextW BeginPaint GetClientRect EndPaint SetCursor MonitorFromPoint GetMonitorInfoW SetWindowPos DialogBoxParamW MessageBoxW LoadImageW SendDlgItemMessageW EndDialog DestroyIcon IsWindowVisible GetParent GetClassNameW GetDpiForWindow SystemParametersInfoW TrackMouseEvent IsRectEmpty PtInRect FillRect FrameRect DrawIconEx DrawTextW LoadIconW RegisterHotKey SetWinEventHook PostMessageW UnhookWinEvent UnregisterHotKey PostQuitMessage FindWindowW CreatePopupMenu AppendMenuW SetForegroundWindow TrackPopupMenuEx DestroyMenu IsIconic GetWindow GetTopWindow GetForegroundWindow IntersectRect GetWindowTextLengthW EnumWindows GetDC GetCursorPos DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjects SetProcessDpiAwarenessContext CloseClipboard GetClipboardData EnumDisplayMonitors

gdi32

CreateRectRgnIndirect LineTo MoveToEx CreatePen GetTextExtentPoint32W GetStockObject SetTextColor SetBkMode CreateSolidBrush CreateFontW SetDIBits CreateRectRgn SetBrushOrgEx SetStretchBltMode CreateCompatibleBitmap GetDIBits DeleteDC BitBlt SelectObject CreateDIBSection CreateCompatibleDC DeleteObject GetObjectW CombineRgn GetRgnBox GetRegionData StretchBlt

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

shell32

CommandLineToArgvW SHGetFolderPathW ord190 ord16 ord18 ord17 SHOpenFolderAndSelectItems Shell_NotifyIconW ShellExecuteW ord155

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegGetValueW

dwmapi

DwmGetWindowAttribute

comdlg32

GetSaveFileNameW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

gdiplus

GdipCreateFromHDC GdipDeleteBrush GdipSetSmoothingMode GdipDrawLine GdipCreatePen1 GdipFillPolygon GdipDeleteGraphics GdipCreateSolidFill GdipFillEllipse GdipDrawLines GdipDeletePen GdipSetPenStartCap GdipSetPenEndCap GdiplusStartup GdipSetPenLineJoin

d2d1

ord1

dwrite

DWriteCreateFactory

kernel32

GetStdHandle ExitProcess CreateProcessW GetConsoleWindow GetLastError CreateMutexW SetLastError CloseHandle LocalFree GetCommandLineW AttachConsole CreateFileW AreFileApisANSI GetModuleHandleW GetConsoleMode GetFileAttributesExW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId WriteConsoleW WideCharToMultiByte GetCurrentThreadId GetSystemTimeAsFileTime GetStartupInfoW WriteFile OutputDebugStringW FindCloseChangeNotification FindFirstChangeNotificationW GetTickCount64 FindNextChangeNotification MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock GlobalFree FindFirstFileW FindNextFileW FindClose GetFullPathNameW FindResourceW SizeofResource LoadResource LockResource GlobalSize CreateDirectoryW GetLocalTime DeleteFileW GetModuleFileNameW MulDiv IsDebuggerPresent InitializeSListHead CompareStringOrdinal

msvcp140

?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ?_Xbad_function_call@std@@YAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context _CxxThrowException memcpy memcmp __C_specific_handler _purecall __std_exception_destroy __std_exception_copy __std_terminate memset memmove

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _exit _invoke_watson _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_wide_environment _configure_wide_argv _errno _initialize_onexit_table _register_onexit_function _set_app_type _crt_atexit _seh_filter_exe terminate _get_wide_winmain_command_line abort

api-ms-win-crt-convert-l1-1-0

strtod strtol

api-ms-win-crt-string-l1-1-0

iswalnum towlower iswspace isspace towupper

api-ms-win-crt-stdio-l1-1-0

fwrite fputc fflush setvbuf fsetpos __stdio_common_vsprintf __stdio_common_vsprintf_s fgetc ungetc fread _fseeki64 fgetpos _get_stream_buffer_pointers fclose __p__commode _set_fmode

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

sinf roundf powf pow floorf asin atan2f sqrtf __setusermatherr ceilf cosf

Sharing

General

Malware Config

Signatures

File Explorer

5a6ccf48db17a89cd5764946f711531ad44802fd5932dc93d1ec8181e1f07317

user32

gdi32

api-ms-win-shcore-scaling-l1-1-1

shell32

advapi32

dwmapi

comdlg32

ole32

gdiplus

d2d1

dwrite

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic