b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66

Sharing

Copy URL Twitter E-mail

General

Target
b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66
Size 824KB
Sample260815-mble6atflg
SHA256 b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66
MD5 046defa36ca7da909d9744e2753fefa2
SHA1 34ec8358bd7ca0caa6c7fb1438670a46625ac3c9
SHA512 4aa1c3aca9715694748eb7acd1b05b86651c549afc0c1531c80ae05649b750c1ae8b48ea83561359fddead43b8bb24ce1618bd10cb6ceb175defc2c7ae1269fd
SSDEEP 24576:yVF4rt3IxVwXkFYcITMFi6KK6wm30wzdHKZ:yVFtkXeDG+i60LzdH
TLSH
T1B605C003B7E95468E473817007677A69AA727C25073099EB03817E6D3D31ED3AE7632B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66

File Explorer

b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66

.exe 824KB

b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66

IMPHASH d59fa5a3d911651235286ccf9d6f6082
SHA256 b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66
MD5 046defa36ca7da909d9744e2753fefa2
SHA1 34ec8358bd7ca0caa6c7fb1438670a46625ac3c9
SHA512 4aa1c3aca9715694748eb7acd1b05b86651c549afc0c1531c80ae05649b750c1ae8b48ea83561359fddead43b8bb24ce1618bd10cb6ceb175defc2c7ae1269fd
SSDEEP 24576:yVF4rt3IxVwXkFYcITMFi6KK6wm30wzdHKZ:yVFtkXeDG+i60LzdH
TLSH
T1B605C003B7E95468E473817007677A69AA727C25073099EB03817E6D3D31ED3AE7632B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dist\BaolaiwuMappingTool_x64.pdb

user32

BeginPaint CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawFocusRect DrawTextW EmptyClipboard EnableWindow EndPaint FillRect FindWindowW GetClassLongPtrW GetClientRect GetDC GetDlgCtrlID GetFocus GetMessageW GetWindowDC GetWindowLongPtrW GetWindowRect GetWindowTextLengthW GetWindowTextW InflateRect InvalidateRect IsDlgButtonChecked IsWindow IsWindowVisible KillTimer LoadCursorW LoadImageW MapWindowPoints MessageBoxW OffsetRect OpenClipboard PostMessageW PostQuitMessage RedrawWindow RegisterClassExW ReleaseDC SendMessageW SetClassLongPtrW SetClipboardData SetCursor SetFocus SetForegroundWindow SetTimer SetWindowPos SetWindowRgn SetWindowTextW ShowWindow TranslateMessage UpdateWindow

gdi32

CreateFontW CreatePen CreateRoundRectRgn CreateSolidBrush DeleteObject GetDeviceCaps LineTo MoveToEx RoundRect SelectObject SetBkColor SetBkMode SetTextColor

comctl32

DefSubclassProc InitCommonControlsEx RemoveWindowSubclass SetWindowSubclass

shell32

SHGetFolderPathW ShellExecuteW

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getsockname getsockopt htonl htons inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA

iphlpapi

GetAdaptersAddresses IcmpCloseHandle IcmpCreateFile IcmpSendEcho

kernel32

CloseHandle CreateDirectoryW CreateEventW CreateFileW CreateMutexW CreateProcessW DeleteCriticalSection EnterCriticalSection ExpandEnvironmentStringsW FlushFileBuffers GetComputerNameA GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSizeEx GetLastError GetLocalTime GetStartupInfoA GetSystemDirectoryW GetTempPathW GetTickCount GetTickCount64 GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeConditionVariable InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryW MulDiv MultiByteToWideChar ReadFile SetEvent SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _commode _errno _fmode _initterm _lock _onexit _snprintf _snprintf_s _snwprintf _stricmp _strnicmp _time64 _unlock _vsnprintf_s _wcsdup _wcsnicmp _wfopen abort atoi calloc exit fclose ferror fflush fgets fgetwc fopen fprintf fputc free fwrite isalnum isalpha isspace iswctype isxdigit localeconv malloc realloc signal strchr strcmp strcpy strerror strlen strncmp strncpy strstr strtol tolower toupper towlower towupper ungetwc vfprintf wcscmp wcscpy wcslen wcsncpy wcstol wcstoul

Name

.text

Size

255KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

551KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

85B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b9e0fdfa1c5433bc3d4e639c37ab4ac385a51ca59022c49a6bb54305318f7b66

user32

gdi32

comctl32

shell32

advapi32

ws2_32

winhttp

bcrypt

crypt32

iphlpapi

kernel32

msvcrt

generic