80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2

Sharing

Copy URL Twitter E-mail

General

Target
80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2
Size 305KB
Sample260814-gp93saff26
SHA256 80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2
MD5 5781a0dcb6f27a304e7bd1cb7f1ee05d
SHA1 a69f84576445b6b98eca6df2734a6cfe01974e67
SHA512 58d9a3bc2ecb337c511a3e4eefd113521059cec4d465b7eac730ea3263ec71790987c5ffa0f720ed76b7218140df489359f6e59bbcfff209526889395e26cd4f
SSDEEP 6144:ucM08ohKPfOQLsv45nCZjc+LJnMaFRNDE:uc587+QLfinMa7NY
TLSH
T148644C12B65988FDD856C07883568773AA7278C64721E9FF139456283F7AAE23F3C704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2

File Explorer

80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2

.exe 305KB

80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2

IMPHASH 8f6d57ed072d199fba56883319c5e15b
SHA256 80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2
MD5 5781a0dcb6f27a304e7bd1cb7f1ee05d
SHA1 a69f84576445b6b98eca6df2734a6cfe01974e67
SHA512 58d9a3bc2ecb337c511a3e4eefd113521059cec4d465b7eac730ea3263ec71790987c5ffa0f720ed76b7218140df489359f6e59bbcfff209526889395e26cd4f
SSDEEP 6144:ucM08ohKPfOQLsv45nCZjc+LJnMaFRNDE:uc587+QLfinMa7NY
TLSH
T148644C12B65988FDD856C07883568773AA7278C64721E9FF139456283F7AAE23F3C704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

216688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

langlock.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

OpenEventW GetLastError GetProcAddress LoadLibraryA CreateEventW SetEvent GetSystemTimeAsFileTime GetCurrentThread SetThreadStackGuarantee InitializeSListHead WaitForSingleObject IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetProcessHeap CloseHandle SwitchToThread CreateThread CreateMutexW LoadLibraryW HeapFree GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP HeapReAlloc AddVectoredExceptionHandler MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW GetFullPathNameW GetModuleHandleW FormatMessageW GetModuleHandleA GetModuleFileNameW WriteFileEx SleepEx ReadFileEx QueryPerformanceCounter QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer Sleep CancelIo GetOverlappedResult ReadFile CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateFileW LoadLibraryExA WaitForMultipleObjects GetExitCodeProcess FreeLibrary IsProcessorFeaturePresent

user32

KillTimer RegisterClassW SetTimer DestroyWindow RegisterWindowMessageA DefWindowProcW SetWindowLongPtrW CreateWindowExW IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SetMenuItemInfoW DrawIconEx GetDC AppendMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW PostQuitMessage ShowWindow SendMessageW SystemParametersInfoA GetActiveWindow RemoveMenu DrawMenuBar SetMenu CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu MessageBoxW CreateIcon DispatchMessageW TranslateMessage PeekMessageW SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx PostMessageW GetForegroundWindow GetAsyncKeyState GetWindowLongPtrW

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc

gdi32

GetDeviceCaps DeleteDC SelectObject CreateDIBSection CreateCompatibleDC SetBkMode SetTextColor CreateSolidBrush DeleteObject

ntdll

RtlNtStatusToDosError NtReadFile RtlGetNtVersionNumbers NtCreateNamedPipeFile NtOpenFile NtWriteFile

shell32

Shell_NotifyIconGetRect Shell_NotifyIconW

oleaut32

SysStringLen GetErrorInfo SysFreeString

vcruntime140

__C_specific_handler memcmp __current_exception memmove memcpy __CxxFrameHandler3 memset __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr round

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _set_app_type _initterm_e exit _exit __p___argc __p___argv _cexit _seh_filter_exe terminate _crt_atexit _register_onexit_function _initialize_onexit_table _c_exit _configure_narrow_argv _register_thread_local_exe_atexit_callback _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

80afe78913901840da74470ba1b6e69fcaf04dbc6fb2ac314b9b960415fe02d2

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

comctl32

gdi32

ntdll

shell32

oleaut32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic