85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff

Sharing

Copy URL Twitter E-mail

General

Target
85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff
Size 610KB
Sample260815-h357esstdz
SHA256 85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff
MD5 318bfea4ae0d226b7e1f38d863bfd197
SHA1 a711b4900c5704544371ad27ecf5ff75290ae854
SHA512 578940c6e58ecf9c776760492e9e0c02c80ab4d6aa4ca036cbddc671e082a68a8c7c4071c0af8d87783f0c3e9d298a83a7baa1f9527c73d119eb87d8bc8d892b
SSDEEP 12288:PicxOB6R48o7lJY0DVaSMWzx49O2lOCjoOu7Hr4SIN3MLSLqkvqg6c1ysDDZ+DIQ:PiwOBG6RyY2ltOub7jw9
TLSH
T13DD45A23BA01E021E5A900746579FBB7A5ACAC347B64D8E7B3805F26D8255F33A34F17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff

File Explorer

85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff

.dll 610KB

85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff

IMPHASH 4fdee4134d14e7e1fc2a0b5bb356e102
SHA256 85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff
MD5 318bfea4ae0d226b7e1f38d863bfd197
SHA1 a711b4900c5704544371ad27ecf5ff75290ae854
SHA512 578940c6e58ecf9c776760492e9e0c02c80ab4d6aa4ca036cbddc671e082a68a8c7c4071c0af8d87783f0c3e9d298a83a7baa1f9527c73d119eb87d8bc8d892b
SSDEEP 12288:PicxOB6R48o7lJY0DVaSMWzx49O2lOCjoOu7Hr4SIN3MLSLqkvqg6c1ysDDZ+DIQ:PiwOBG6RyY2ltOub7jw9
TLSH
T13DD45A23BA01E021E5A900746579FBB7A5ACAC347B64D8E7B3805F26D8255F33A34F17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

448353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\Work2019\PA\Output\Win32\Unlimited\up.pdb

kernel32

SetFilePointer CreateDirectoryA CreateFileA WriteFile OutputDebugStringA GlobalMemoryStatusEx GetLocalTime GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryW SetEvent OpenEventW TerminateProcess CreateProcessW SetHandleInformation CreatePipe GetExitCodeProcess TerminateThread GetModuleHandleW LoadLibraryA GetTickCount InitializeCriticalSectionEx FreeResource LoadResource SizeofResource FindResourceW ReleaseMutex CreateMutexW PeekNamedPipe GetStartupInfoW GetStdHandle GetFileSizeEx SetVolumeMountPointW OutputDebugStringW SetLastError GetSystemInfo GetVersionExA AllocConsole WriteConsoleA WriteConsoleW DeleteFileW DeleteCriticalSection GetSystemDirectoryW GetWindowsDirectoryW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW RemoveDirectoryA RemoveDirectoryW lstrlenW MoveFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount GetSystemWindowsDirectoryW Sleep DeviceIoControl GetVolumeNameForVolumeMountPointW FlushFileBuffers DeleteVolumeMountPointW CreateFileW WideCharToMultiByte MultiByteToWideChar GlobalFree GetPrivateProfileStringA OpenMutexW GetPrivateProfileIntA MapViewOfFile CreateFileMappingW WritePrivateProfileStringA DeleteFileA GetFileAttributesA ReadFile GetLastError CopyFileA GetPrivateProfileStringW UnmapViewOfFile OpenFileMappingW GetVersionExW GetFileAttributesW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW GetPrivateProfileIntW EnterCriticalSection WritePrivateProfileStringW IsBadWritePtr GetModuleFileNameA CreateDirectoryW IsBadReadPtr WaitForSingleObject GlobalUnlock GlobalLock CreateThread CloseHandle GlobalAlloc SetFilePointerEx InitializeSListHead

user32

CreateDialogParamW IsWindow CreateWindowExW RegisterClassW CallWindowProcW DefWindowProcW DispatchMessageW TranslateMessage GetMessageW GetWindowLongW SetWindowLongW ReleaseDC GetDC SetPropW ScreenToClient PtInRect SetParent PostMessageW GetWindowRect IsZoomed SendMessageW EndDialog SetWindowTextW ShowWindow OpenClipboard OffsetRect GetDlgCtrlID CloseClipboard GetPropW RemovePropW IsWindowVisible GetParent EnableWindow EndPaint BeginPaint GetDlgItem GetClientRect SetCursor DrawTextW DrawIconEx TrackMouseEvent SetWindowPos IsWindowEnabled GetWindowDC InvalidateRect SetClipboardData LoadCursorW MoveWindow GetWindowTextA EmptyClipboard FindWindowW GetWindowTextW SetWindowRgn ClientToScreen wsprintfW ReleaseCapture SetCapture GetIconInfo LoadImageW DestroyIcon SystemParametersInfoW GetScrollInfo SetScrollInfo MessageBoxW

gdi32

SetBkColor MoveToEx LineTo CreateRectRgn ExcludeClipRect GetObjectW GetStockObject GetGlyphOutlineW DeleteDC CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt EnumFontFamiliesW GetDeviceCaps CreateFontIndirectW SetTextColor SetBkMode CreateSolidBrush SelectObject GetTextExtentPoint32W ExtTextOutW DeleteObject

advapi32

RegSetValueExW RegSetValueExA RegFlushKey RegDeleteValueW RegQueryInfoKeyW RegEnumKeyW RegUnLoadKeyW RegOpenKeyExW RegLoadKeyW AdjustTokenPrivileges OpenProcessToken RegQueryValueExA RegOpenKeyA RegOpenKeyW RegCloseKey RegOpenKeyExA RegQueryValueExW

shell32

SHGetFolderPathW ShellExecuteW SHAppBarMessage

ole32

CoGetClassObject OleInitialize OleUninitialize OleSetContainedObject CreateStreamOnHGlobal

oleaut32

VariantInit SysAllocString SafeArrayCreate SafeArrayAccessData VariantClear SafeArrayDestroy

gdiplus

GdipLoadImageFromStreamICM GdipLoadImageFromFileICM GdipCloneImage GdipDisposeImage GdipLoadImageFromFile GdiplusStartup GdipAlloc GdipFree GdipLoadImageFromStream GdipCreatePath GdipDrawImageRectRect GdipDeletePath GdipFillPath GdipClosePathFigure GdipAddPathLineI GdipDrawImageRect GdipAddPathArcI GdipCloneBrush GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipGetImageHeight GdipGetImageWidth GdipDeletePen GdipCreatePen1 GdipCreateLineBrushFromRect GdipCreateSolidFill GdipDeleteBrush GdipDrawPath

ntdll

NtLoadDriver ZwQueryVolumeInformationFile ZwQueryDirectoryObject ZwOpenDirectoryObject NtUnloadDriver ZwOpenSymbolicLinkObject ZwClose ZwCreateFile RtlInitUnicodeString ZwQuerySymbolicLinkObject

msvcp140

?uncaught_exception@std@@YA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Xout_of_range@std@@YAXPBD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPBD@Z

ws2_32

WSAStartup gethostbyname WSACleanup WSAGetLastError

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

HttpQueryInfoA InternetSetOptionW InternetConnectA HttpOpenRequestA InternetOpenA InternetReadFile HttpSendRequestA InternetCloseHandle InternetOpenUrlA

winhttp

WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSendRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpReceiveResponse WinHttpQueryDataAvailable

vcruntime140

__current_exception_context __CxxFrameHandler3 __std_type_info_destroy_list _except_handler4_common __std_terminate __current_exception memchr strchr wcschr strstr memset memmove memcpy _CxxThrowException strrchr wcsrchr _purecall wcsstr __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vsprintf_s __stdio_common_vfprintf __stdio_common_vswprintf __stdio_common_vsprintf __acrt_iob_func

api-ms-win-crt-convert-l1-1-0

mbstowcs atoi strtol _wtoi _wtoi64 wcstombs _itoa

api-ms-win-crt-string-l1-1-0

_wcsicmp wcscpy _wcsnicmp wcslen wcsncpy_s wcscat_s _wcslwr tolower wcscpy_s strncpy wcsncpy _strnicmp toupper strncmp _stricmp strcpy_s

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _errno terminate _register_onexit_function _execute_onexit_table _crt_atexit _invalid_parameter_noinfo _crt_at_quick_exit _cexit _initterm _invalid_parameter_noinfo_noreturn _initterm_e _beginthreadex _seh_filter_dll _initialize_onexit_table

api-ms-win-crt-time-l1-1-0

_mktime64 _localtime64_s strftime _time64 _localtime64

api-ms-win-crt-heap-l1-1-0

calloc malloc free _callnewh

api-ms-win-crt-math-l1-1-0

floor _libm_sse2_pow_precise _except1

api-ms-win-crt-utility-l1-1-0

rand srand

Sharing

General

Malware Config

Signatures

File Explorer

85d6f50125334a30702039a1eabc29435cf8c17186a26f11d04088b7e78bc1ff

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

ntdll

msvcp140

ws2_32

version

wininet

winhttp

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic