aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437

Sharing

Copy URL Twitter E-mail

General

Target
aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437
Size 4.6MB
Sample260813-vsja5acp71
SHA256 aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437
MD5 151508d1e52544ac01412c7cfc427a96
SHA1 d07a5fd211584bcd3596702d2aa69d5f1aa38b55
SHA512 fd8b154eacad5584cf932fd06628fa82848c7811b61efec77da7f95cff086d98c5a6bcd218dce6ed9766576f64ef75050e5594014ec36bae83159c826cc506cb
SSDEEP 49152:p6s6yu6aXgU+R2JGsh+mEVLnmBgCV/nBl/7MkRmtVwht7vrDhhJxS5VCoxRIVNC2:wmLb2V11SDxRYT1sH
TLSH
T19E262A11BB9A99ACC05AC474838A4A721A35B4CB0B35BAFF41D442753FA9EF41F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437

File Explorer

aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437

.exe 4.6MB

aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437

IMPHASH 97265ad904f539c6f52081dc73b74ef4
SHA256 aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437
MD5 151508d1e52544ac01412c7cfc427a96
SHA1 d07a5fd211584bcd3596702d2aa69d5f1aa38b55
SHA512 fd8b154eacad5584cf932fd06628fa82848c7811b61efec77da7f95cff086d98c5a6bcd218dce6ed9766576f64ef75050e5594014ec36bae83159c826cc506cb
SSDEEP 49152:p6s6yu6aXgU+R2JGsh+mEVLnmBgCV/nBl/7MkRmtVwht7vrDhhJxS5VCoxRIVNC2:wmLb2V11SDxRYT1sH
TLSH
T19E262A11BB9A99ACC05AC474838A4A721A35B4CB0B35BAFF41D442753FA9EF41F3C758
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3295384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

noconsole.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

SetUnhandledExceptionFilter CloseHandle UnhandledExceptionFilter GetModuleHandleExW LoadLibraryW GetProcAddress CreateMutexA IsDebuggerPresent WaitForSingleObjectEx CreateThread WideCharToMultiByte WriteConsoleW MultiByteToWideChar UpdateProcThreadAttribute InitializeProcThreadAttributeList GetFileAttributesW CreateProcessW InitializeSListHead GetSystemTimeAsFileTime GetSystemDirectoryW LoadLibraryA GetFullPathNameW ReadFileEx CreateNamedPipeW GetCurrentThreadId OpenProcess GetCurrentThread ExitProcess GetModuleFileNameW GetModuleHandleW GetFileType GetProcessHeap HeapFree HeapAlloc LoadLibraryExA FreeLibrary CopyFileExW GetLastError FormatMessageW WaitForSingleObject GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute SetThreadPriority GetWindowsDirectoryW GetTimeZoneInformationForYear Sleep GetModuleHandleA GetConsoleMode SetConsoleMode MoveFileExW DeleteFileW FindFirstFileW CreateDirectoryW lstrlenW GetFileInformationByHandleEx GetFileInformationByHandle CreateFileW FindClose FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread CreateWaitableTimerExW SetWaitableTimer QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileInformationByHandle GetCurrentProcess DuplicateHandle ReleaseMutex HeapReAlloc GetSystemTimePreciseAsFileTime QueryPerformanceFrequency GetExitCodeProcess SleepEx WriteFileEx GetCurrentProcessId IsProcessorFeaturePresent

user32

UnhookWinEvent DispatchMessageA TranslateMessage GetMessageA SetWinEventHook PostThreadMessageW CallNextHookEx UnhookWindowsHookEx GetMessageW GetMonitorInfoW RedrawWindow SetWindowsHookExW GetWindowLongW IsIconic GetWindowLongPtrW GetAsyncKeyState MessageBoxW DrawTextW GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo GetActiveWindow ClientToScreen SetWindowPos SetMenuItemInfoW AppendMenuW InsertMenuW EnumDisplayMonitors DestroyAcceleratorTable CreatePopupMenu CreateMenu DestroyMenu PostQuitMessage SetWindowLongPtrW RegisterClassExW CreateWindowExW RemoveMenu IsProcessDPIAware SetFocus GetWindowPlacement DrawIconEx ReleaseDC GetDpiForWindow IsWindowVisible SetForegroundWindow GetDC SendInput GetMenuItemInfoW SystemParametersInfoA GetForegroundWindow DrawMenuBar InvalidateRect BeginPaint GetWindowRect SetMenu LoadImageW SetTimer TrackPopupMenu KillTimer DefWindowProcW RegisterClassW RegisterWindowMessageA CreateAcceleratorTableW DestroyIcon ShowWindow SendMessageW MonitorFromWindow DestroyWindow EnumWindows GetTitleBarInfo GetWindow GetWindowTextW CheckMenuItem GetWindowThreadProcessId RealGetWindowClassW GetCursorPos GetKeyState PostMessageW SetLayeredWindowAttributes EndPaint FillRect GetSysColorBrush GetClientRect

dwmapi

DwmGetWindowAttribute

gdi32

SetTextColor DeleteObject GetDeviceCaps SelectObject Rectangle CreateDIBSection CreateSolidBrush DeleteDC SetBkMode CreateCompatibleDC CreatePen

psapi

GetModuleFileNameExW

shell32

Shell_NotifyIconGetRect SHGetKnownFolderPath Shell_NotifyIconW

ole32

CoIncrementMTAUsage CoCreateInstance CoTaskMemFree

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

oleaut32

SysStringLen GetErrorInfo SysFreeString

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

vcruntime140

memcpy __current_exception_context __current_exception __C_specific_handler _CxxThrowException memcmp memmove __CxxFrameHandler3 memset

api-ms-win-crt-math-l1-1-0

powf __setusermatherr cosf round roundf exp2f sinf

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe _c_exit terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

aa72312813da5ce69668fc3d9f3bf314615150bd638138bc3dba393d8d9d6437

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

user32

dwmapi

gdi32

psapi

shell32

ole32

comctl32

oleaut32

bcrypt

advapi32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic