d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174.exe
Size 1.2MB
Sample260816-wplgratfld
SHA256 d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174
MD5 76c5dc08ceb375c1a33617375d02ed95
SHA1 0272bad50a88bc8d3d7b8c6e4e894a2c6a99140d
SHA512 5b9567a27b80582d268d636f30c578ac54555d6c6cee1bc89c491485234387d842dfc27da554db5c3e039a37080681f079f025bfb281d30760f28f418d99d971
SSDEEP 24576:exwz9PDC5/WD+qQGGLQqFfPxf7mdlWDSJggE6:exwx+qQRQqFhfbSJ
TLSH
T18145BF1AA39511E5E53BC13D8DA69A52FEB1B84A07309BC703D446A92F23FF45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174.exe

File Explorer

d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174.exe

.exe 1.2MB

d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174.exe

IMPHASH 84bfecb6d94378cbca4bbc69ce9d9882
SHA256 d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174
MD5 76c5dc08ceb375c1a33617375d02ed95
SHA1 0272bad50a88bc8d3d7b8c6e4e894a2c6a99140d
SHA512 5b9567a27b80582d268d636f30c578ac54555d6c6cee1bc89c491485234387d842dfc27da554db5c3e039a37080681f079f025bfb281d30760f28f418d99d971
SSDEEP 24576:exwz9PDC5/WD+qQGGLQqFfPxf7mdlWDSJggE6:exwx+qQRQqFhfbSJ
TLSH
T18145BF1AA39511E5E53BC13D8DA69A52FEB1B84A07309BC703D446A92F23FF45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

338688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileA CreateDirectoryA CreateFileA CreateFileW CreateMutexW CreateProcessA CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW EncodePointer EnterCriticalSection EnumResourceNamesW EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileAttributesA GetFileSize GetFileSizeEx GetFileType GetLargePageMinimum GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDefaultLocaleName GetSystemDirectoryA GetSystemTimeAsFileTime GetTempFileNameA GetTempFileNameW GetTempPathA GetTempPathW GetThreadLocale GetTickCount GetTimeFormatW GetUserDefaultLCID GetUserDefaultLocaleName GetUserDefaultUILanguage HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MoveFileExA MultiByteToWideChar OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RemoveVectoredExceptionHandler RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEnvironmentVariableW SetFileAttributesA SetFilePointerEx SetLastError SetStdHandle SetThreadUILanguage SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile lstrcatA lstrcmpA

user32

CloseClipboard DestroyMenu DispatchMessageW DrawTextW FillRect GetAsyncKeyState GetCaretBlinkTime GetDC GetDoubleClickTime GetKeyState GetKeyboardLayout GetSystemMetrics IsClipboardFormatAvailable LoadAcceleratorsW LoadMenuW LoadStringW MsgWaitForMultipleObjects OpenClipboard PeekMessageW ReleaseDC SystemParametersInfoW TranslateMessage wsprintfA

shell32

SHGetFileInfoW SHGetKnownFolderPath ShellExecuteExW

comctl32

InitCommonControlsEx

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize OleInitialize

uxtheme

IsAppThemed IsThemeActive

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextMetricsW SelectObject SetBkMode SetTextColor

comdlg32

ChooseColorW ChooseFontW FindTextW GetOpenFileNameW GetSaveFileNameW PrintDlgW ReplaceTextW

shlwapi

PathAppendW PathFileExistsW PathFindFileNameW PathIsDirectoryW PathRemoveFileSpecW

advapi32

AllocateAndInitializeSid FreeSid GetNamedSecurityInfoA GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExA RegSetValueExA SetEntriesInAclA SetNamedSecurityInfoA

oleaut32

SysAllocStringLen SysFreeString VariantInit

Name

.text

Size

765KB

Virtual Size

765KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcmp_

Size

512B

Virtual Size

88B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

332B

Characteristics

Name

memset_

Size

512B

Virtual Size

120B

Characteristics

Name

.rsrc

Size

254KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174.exe

kernel32

user32

shell32

comctl32

ole32

uxtheme

version

gdi32

comdlg32

shlwapi

advapi32

oleaut32

generic