b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a

Sharing

Copy URL Twitter E-mail

General

Target
b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a
Size 853KB
Sample260814-e2417acp4t
SHA256 b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a
MD5 376082cd1fafcaa3a511fa1cf75cb679
SHA1 68866fab5e9325fde0ccb08e67fdb220b94b84bd
SHA512 db4369c0871f749497e672c261fda92c2c437c60d21c4c4995e8b3bbd1301cf1a5b9668a6cee85111e349bd8a07758f9c3ec9ef3453ba3cfd68b47080ff4979d
SSDEEP 12288:L0eUXSjz+wkutYpuTaJx7Z+/+W4l0F+eUDMuossXM:L0S2ZuSpuTaJ1Z+/+W1F+esHx
TLSH
T170058D5BE9A911ADE06BC078C9EB5516F7717C1A076096EB03D09A6A3F33BD0473EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a

File Explorer

b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a

.dll 853KB

b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a

IMPHASH a830a24ca6ae637c290f0113c3647760
SHA256 b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a
MD5 376082cd1fafcaa3a511fa1cf75cb679
SHA1 68866fab5e9325fde0ccb08e67fdb220b94b84bd
SHA512 db4369c0871f749497e672c261fda92c2c437c60d21c4c4995e8b3bbd1301cf1a5b9668a6cee85111e349bd8a07758f9c3ec9ef3453ba3cfd68b47080ff4979d
SSDEEP 12288:L0eUXSjz+wkutYpuTaJx7Z+/+W4l0F+eUDMuossXM:L0S2ZuSpuTaJ1Z+/+W1F+esHx
TLSH
T170058D5BE9A911ADE06BC078C9EB5516F7717C1A076096EB03D09A6A3F33BD0473EB01
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

477780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Work\MonitorV3_Other\x64\Release\SystemUIExt.pdb

kernel32

FindFirstFileW FindNextFileW WriteFile FindClose CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW GetLocalTime GetFileSize InitializeCriticalSectionEx MultiByteToWideChar GetLastError DecodePointer DeleteCriticalSection WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx SetThreadPriority SetEndOfFile ReadFile ReadConsoleW SetStdHandle HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetTickCount64 CreateProcessW GetCurrentProcessId CreateThread CloseHandle Process32FirstW OutputDebugStringW DisableThreadLibraryCalls Process32NextW Sleep CreateToolhelp32Snapshot WriteConsoleW GetModuleFileNameW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation GetFileType GetStdHandle HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue RtlUnwind FlsGetValue FlsAlloc SetLastError InterlockedFlushSList LocalFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx SleepConditionVariableSRW WakeAllConditionVariable RtlPcToFileHeader RaiseException EncodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlLookupFunctionEntry RtlUnwindEx

user32

GetCursorInfo TranslateMessage SetWindowsHookExW ToUnicode GetMonitorInfoW OpenInputDesktop GetUserObjectInformationW ReleaseDC GetForegroundWindow DispatchMessageW GetKeyboardState GetShellWindow CallNextHookEx GetMessageW GetWindowTextLengthW GetWindowTextW UnhookWindowsHookEx CloseDesktop MonitorFromPoint GetLastInputInfo GetDC EnumDisplayMonitors GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject BitBlt

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW GetUserNameW

shell32

SHChangeNotify SHCreateDirectoryExW

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

SHDeleteKeyW

ws2_32

WSACleanup accept bind closesocket listen WSAStartup htons recv socket send

wininet

InternetOpenW InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA HttpQueryInfoW

Name

.text

Size

642KB

Virtual Size

642KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b1a3b4a9eb78476c316338f795e1553415da8e4a2aecd36aa7faaf17b441439a

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wininet

generic