df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455

Sharing

Copy URL Twitter E-mail

General

Target
df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455
Size 8.5MB
Sample260813-ysgdbaxerc
SHA256 df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455
MD5 7ae9714aa1ac01e6d1bf1d861ccd286f
SHA1 f8c1ca9e13f1f4f5ee9bb843859ed6c4d4a73f79
SHA512 dc07711d65989711797b9fda203a437eef46f60de424ab0f750edb79ad840fd037eaa3777cd55581da62e99ab2def9c03afbea21c9a279780b7d26fabdf6d3aa
SSDEEP 98304:w190oVIeFFtDOiO0f/eVVcf2aAxn/LHWiYJVDvJ90Ibn:clVIeFFBxNDx5
TLSH
T1B396D4217B5F996CD19BC4B482874A72497130CB0B36B9FF549592382F6ABF42F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455

File Explorer

df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455

.exe 8.5MB

df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455

IMPHASH feb0db057e0b1c7ae263038188130747
SHA256 df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455
MD5 7ae9714aa1ac01e6d1bf1d861ccd286f
SHA1 f8c1ca9e13f1f4f5ee9bb843859ed6c4d4a73f79
SHA512 dc07711d65989711797b9fda203a437eef46f60de424ab0f750edb79ad840fd037eaa3777cd55581da62e99ab2def9c03afbea21c9a279780b7d26fabdf6d3aa
SSDEEP 98304:w190oVIeFFtDOiO0f/eVVcf2aAxn/LHWiYJVDvJ90Ibn:clVIeFFBxNDx5
TLSH
T1B396D4217B5F996CD19BC4B482874A72497130CB0B36B9FF549592382F6ABF42F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6110720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mirror_windows.pdb

bcryptprimitives

ProcessPrng

advapi32

EventRegister RegOpenKeyExW RegQueryValueExW RegCloseKey EventUnregister EventWriteTransfer OpenProcessToken GetTokenInformation EventSetInformation RegGetValueW

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile RtlGetVersion NtWriteFile RtlNtStatusToDosError

kernel32

TlsAlloc EncodePointer TlsGetValue RaiseException RtlPcToFileHeader IsProcessorFeaturePresent TlsSetValue FindNextFileW LoadLibraryExA FormatMessageW GetProcessHeap HeapFree TlsFree InitializeSListHead RtlLookupFunctionEntry RtlCaptureContext TerminateProcess lstrlenW LoadLibraryA IsDebuggerPresent GetSystemInfo GetSystemTimeAsFileTime QueryPerformanceCounter GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW GetWindowsDirectoryW LoadLibraryW GetSystemDirectoryW SleepConditionVariableSRW WakeAllConditionVariable CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle WriteConsoleW MultiByteToWideChar QueryPerformanceFrequency SleepEx ReadFileEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleW GetUserDefaultUILanguage ExitProcess GetTempPathW GetFullPathNameW SetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW UnhandledExceptionFilter SwitchToThread GetFileInformationByHandleEx CreateDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForSingleObject DuplicateHandle GetCurrentProcess LCIDToLocaleName OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW SetUnhandledExceptionFilter RtlUnwindEx FreeLibrary SetFileInformationByHandle ReleaseMutex GetCurrentThreadId GetCurrentProcessId CreateMutexA WaitForSingleObjectEx WideCharToMultiByte HeapReAlloc GetEnvironmentVariableW GetModuleHandleA Sleep CreateFileW GetProcAddress GetLastError CloseHandle InitializeCriticalSectionAndSpinCount GetConsoleMode GetFileInformationByHandle DeleteCriticalSection OpenProcess GetFileAttributesW HeapAlloc QueryFullProcessImageNameW RtlVirtualUnwind

user32

DrawTextW SetProcessDpiAwarenessContext DestroyWindow TranslateAcceleratorW GetWindowDC ScreenToClient GetWindowLongW GetClientRect PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable GetMenuItemInfoW CreateIcon ToUnicodeEx GetKeyboardLayout GetKeyState GetKeyboardState ClientToScreen MapVirtualKeyExW GetMenu SystemParametersInfoA SetPropW SetWindowLongW EnableMenuItem GetSystemMenu ClipCursor GetClipCursor ShowCursor MonitorFromRect FillRect SystemParametersInfoW TrackMouseEvent RedrawWindow GetTouchInputInfo CloseTouchInputHandle GetSystemMetrics SetCursor GetCursorPos GetRawInputData MonitorFromPoint SetWindowTextW SetWindowDisplayAffinity SendInput SetForegroundWindow TrackPopupMenu InsertMenuW MonitorFromWindow GetMonitorInfoW RegisterRawInputDevices ReleaseCapture AppendMenuW MsgWaitForMultipleObjectsEx SetMenuItemInfoW DrawMenuBar RegisterWindowMessageA SetParent GetWindow SetFocus IsProcessDPIAware SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled SetMenu CreateMenu CreatePopupMenu RemoveMenu ValidateRect CheckMenuItem PostThreadMessageW PeekMessageW GetUpdateRect SendMessageW GetForegroundWindow TranslateMessage SetCapture AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DestroyMenu InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW MapVirtualKeyW AdjustWindowRect ShowWindow IsZoomed DrawIconEx ReleaseDC IsIconic DestroyIcon GetDC GetIconInfo GetWindowRect GetWindowTextW GetWindowThreadProcessId GetWindowTextLengthW IsWindowVisible EnumDisplayMonitors EnumWindows GetMessageW UnhookWindowsHookEx SetWindowsHookExW SendMessageTimeoutW GetAsyncKeyState MapWindowPoints ChildWindowFromPointEx GetAncestor WindowFromPoint CallNextHookEx IsWindow LoadCursorW PostMessageW GetMenuBarInfo RegisterTouchWindow EnumChildWindows DispatchMessageA GetMessageA SetWindowPos CreateWindowExW RegisterClassExW OffsetRect DispatchMessageW

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance RegisterDragDrop CoInitializeEx RevokeDragDrop CoUninitialize CoTaskMemAlloc OleInitialize CoTaskMemFree

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

gdi32

SetTextColor CreateSolidBrush SetBkMode CreateRectRgn DeleteObject CreateDIBSection CreateCompatibleDC GetObjectW BitBlt GetDeviceCaps CombineRgn SelectObject DeleteDC

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

shell32

DragFinish SHGetKnownFolderPath SHAppBarMessage SHGetFileInfoW DragQueryFileW ShellExecuteW

api-ms-win-crt-math-l1-1-0

round roundf pow __setusermatherr trunc ceil floor

api-ms-win-crt-string-l1-1-0

wcsncmp strcmp _wcsicmp strlen wcscmp wcslen strcpy_s

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _configure_narrow_argv exit _c_exit __p___argc _initterm _initialize_onexit_table _initialize_narrow_environment _initterm_e _get_initial_narrow_environment _register_onexit_function abort _cexit _exit __p___argv terminate _crt_atexit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free calloc _set_new_mode _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

df6e81ee0a1a0cbfdce1c3946bcd46b7a504a5e471afe338a7b0563ee5313455

bcryptprimitives

advapi32

ntdll

kernel32

user32

ole32

comctl32

gdi32

shlwapi

api-ms-win-core-synch-l1-2-0

dwmapi

api-ms-win-shcore-scaling-l1-1-1

oleaut32

shell32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic