8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144

Sharing

Copy URL Twitter E-mail

General

Target
8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144
Size 536KB
Sample260813-swt6pasvav
SHA256 8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144
MD5 4dc817e66a2e2bf8125cb266a24bcd80
SHA1 f91f26d4cfab292bca775ebb5ea7fd2583e40bd2
SHA512 7959c546a103b66640df06bc204e6298131938afae158dcde4e250015b18e9c1919a3654102a5cfeea3e7858541458eff409e771a7262464768297b485ac6c70
SSDEEP 12288:sG/fX9rhmsdW5jivju3w1SC4LqwRlqeMb01JQntLOC+sQW://P9wsdWt4Cw4xLEem+J
TLSH
T1BCC4F51366DCBCA8E17216706B7B97E1977EFC201B30C59F22C0151DA97C9C2BA31B96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144

File Explorer

8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144

.exe 536KB

8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144

IMPHASH d90c5f63eb809bc37f835a735e1e9181
SHA256 8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144
MD5 4dc817e66a2e2bf8125cb266a24bcd80
SHA1 f91f26d4cfab292bca775ebb5ea7fd2583e40bd2
SHA512 7959c546a103b66640df06bc204e6298131938afae158dcde4e250015b18e9c1919a3654102a5cfeea3e7858541458eff409e771a7262464768297b485ac6c70
SSDEEP 12288:sG/fX9rhmsdW5jivju3w1SC4LqwRlqeMb01JQntLOC+sQW://P9wsdWt4Cw4xLEem+J
TLSH
T1BCC4F51366DCBCA8E17216706B7B97E1977EFC201B30C59F22C0151DA97C9C2BA31B96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225168

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dbs\el\ddvsm\out\binaries\x86ret\bin\i386\Bootstrapper\Engine\setup.pdb

kernel32

OpenProcess GetNativeSystemInfo EndUpdateResourceW VerifyVersionInfoW CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEvent CreateEventW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW GetTempFileNameW Sleep GetTempPathW GetCurrentProcess GetSystemInfo GetSystemDirectoryW GetWindowsDirectoryW GetVersionExW GetModuleFileNameW GetModuleHandleA GlobalAlloc GlobalFree LocalFree FormatMessageW CopyFileW GetDateFormatW GetTimeFormatW CompareStringW WideCharToMultiByte InitializeCriticalSectionAndSpinCount HeapSetInformation SetFilePointer GetDiskFreeSpaceExW CreateFileW VerSetConditionMask DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrlenW GetCurrentProcessId MulDiv GetTickCount GetExitCodeProcess LoadLibraryW ReadFile SwitchToThread FindNextFileW UpdateResourceA BeginUpdateResourceA FindResourceA lstrlenA DeleteFileA CreateFileA UpdateResourceW BeginUpdateResourceW GetVersion GetEnvironmentVariableA LCMapStringEx InitializeCriticalSectionEx WriteConsoleW HeapReAlloc HeapSize GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP SetEndOfFile IsValidCodePage FindFirstFileExW OutputDebugStringW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FindFirstFileW FindClose GetProcAddress FreeLibrary WaitForSingleObject GetLastError CloseHandle WriteFile HeapFree HeapAlloc GetFileType GetModuleHandleExW ExitProcess GetStdHandle LoadLibraryExW TlsFree TlsSetValue RaiseException VirtualProtect VirtualQuery GetModuleHandleW LoadLibraryExA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwind SetLastError TlsAlloc TlsGetValue

gdi32

GetStockObject EnumFontFamiliesExW DeleteObject CreateFontIndirectW GetObjectW GetTextMetricsW SelectObject GetTextExtentPoint32W GetDeviceCaps DeleteDC CreateCompatibleDC

ole32

CoUninitialize CoInitialize

secur32

GetComputerObjectNameW

shell32

SHGetMalloc ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation ShellExecuteW ShellExecuteA

user32

SystemParametersInfoW IsDialogMessageW LoadImageW LoadIconW LoadCursorW SetClassLongW SetCursor GetWindowRect GetClientRect SetWindowTextW ShowScrollBar SetForegroundWindow EnableWindow MsgWaitForMultipleObjects GetFocus SetFocus SendDlgItemMessageW SetDlgItemTextW GetDlgItem CreateDialogIndirectParamW CreateDialogParamW MoveWindow ShowWindow DestroyWindow SendMessageW SendMessageA PeekMessageW DispatchMessageW TranslateMessage ExitWindowsEx MessageBoxW ReleaseDC GetDC DrawTextW GetSystemMetrics GetDialogBaseUnits MessageBoxA ScreenToClient

crypt32

CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy

wininet

InternetCrackUrlW InternetCombineUrlW

msi

ord92 ord150 ord78 ord8

shlwapi

UrlUnescapeW

Name

.text

Size

373KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8489690de75b476bff29dc66d42898f22373940ff366aef65c0043fc5f093144

kernel32

gdi32

ole32

secur32

shell32

user32

crypt32

wininet

msi

shlwapi

generic