17082026_1534_17082026_KGLWIN_V3[.]66_200706 _EN_[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
17082026_1534_17082026_KGLWIN_V3.66_200706 _EN_.zip
Size 6.9MB
Sample260817-szvxdstdme
SHA256 61caaf3a6422af4b4523b204d6372eb9aebd3e43c4c93a36e0ff8964044fc6c2
MD5 d3bf02c70887350117f7f4dbcd4b24fb
SHA1 56c4dbf2b979294f12c046d58e747176029dfa6c
SHA512 2842bbc24a7543eadd511cf8667ea691f4c1acb3c0330ed5cd544ebc516357c39d5885cda8fae974f3441f0678f2e0f31755775ab0e6490dc75a12da59062b82
SSDEEP 196608:XiWxWHZodfPyn66Gc47yqgbr4R7kkUhPS1ybKKQzju:yo+mdf36p4ng3JR2Pju
TLSH
T1D2763382852B4BCA605E3542F270380961BBCF5D3F5DD6F9158AA0D1924EFF5AB13B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KGLWIN_V3p66_200706.exe

File Explorer

17082026_1534_17082026_KGLWIN_V3.66_200706 _EN_.zip

.zip 6.9MB
KGLWIN_V3p66_200706.exe

.exe 7.7MB

17082026_1534_17082026_KGLWIN_V3.66_200706 _EN_.zip

SHA256 61caaf3a6422af4b4523b204d6372eb9aebd3e43c4c93a36e0ff8964044fc6c2
MD5 d3bf02c70887350117f7f4dbcd4b24fb
SHA1 56c4dbf2b979294f12c046d58e747176029dfa6c
SHA512 2842bbc24a7543eadd511cf8667ea691f4c1acb3c0330ed5cd544ebc516357c39d5885cda8fae974f3441f0678f2e0f31755775ab0e6490dc75a12da59062b82
SSDEEP 196608:XiWxWHZodfPyn66Gc47yqgbr4R7kkUhPS1ybKKQzju:yo+mdf36p4ng3JR2Pju
TLSH
T1D2763382852B4BCA605E3542F270380961BBCF5D3F5DD6F9158AA0D1924EFF5AB13B13
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

KGLWIN_V3p66_200706.exe

IMPHASH 5157a01242cf96a580e79c8c7168eaac
SHA256 6403c5ba82eb98d82a2a7e318faf41b7286ef538517ba6328c3ea70068365d2a
MD5 568ff339e2250fdad2970011a0433f79
SHA1 4fe64d84296b202d645b7f3d0cf580f8375230f7
SHA512 b5260477f0b5d609c6376db138dc0899a0f231aa10dd924bf21386bbe9a04235cefa427f93094593eb4a0c9c3783aeff15b7720788bb5fcb261ae06749973b0b
SSDEEP 196608:8k8huipT3NtJ1iBATvLdYIjj8wHlkEy1lHiLQj6kP:87jTd1cA/dYUQkdWzuM
TLSH
T12F861202E7E7905EFABF4638983726705BBAFE116E38C1AF3784759D1830E909931716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

141865

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

DeleteCriticalSection GetShortPathNameA SetEvent HeapDestroy GetDriveTypeA GetExitCodeProcess CopyFileA lstrcpynA GetFileAttributesA FindClose FindFirstFileA CreateDirectoryA GetCurrentThreadId LoadLibraryA SetFilePointer LoadLibraryExA GetTickCount GetWindowsDirectoryA FormatMessageA LocalFree SetFileAttributesA UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize SizeofResource GetTempPathA GlobalSize FreeResource GetLocalTime GetCurrentProcessId SearchPathA FindNextFileA GetTempFileNameA TerminateProcess IsBadReadPtr VirtualQuery VirtualProtect ResetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA GetCurrentThread MoveFileExA GetDiskFreeSpaceA GetSystemDirectoryA GetSystemInfo GetPrivateProfileStringA GetPrivateProfileIntA MultiByteToWideChar lstrcpyA lstrcmpiA lstrlenA GetSystemDefaultLangID lstrcatA SetLastError GetLastError WideCharToMultiByte CompareStringA CompareStringW GetVersionExA GetProcAddress MulDiv GetPrivateProfileSectionNamesA FlushFileBuffers SetStdHandle IsBadCodePtr GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter SetUnhandledExceptionFilter HeapSize IsBadWritePtr VirtualAlloc VirtualFree HeapCreate GetEnvironmentVariableA TlsGetValue TlsAlloc TlsSetValue GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo GetCommandLineA GetStartupInfoA RaiseException HeapReAlloc HeapAlloc HeapFree RtlUnwind InterlockedExchange InitializeCriticalSection GetModuleHandleA GetModuleFileNameA Sleep CloseHandle ReleaseMutex CreateMutexA ReadFile WriteFile CreateEventA QueryPerformanceFrequency InterlockedDecrement InterlockedIncrement CreateFileA CreateThread EnterCriticalSection LeaveCriticalSection FreeLibrary SetErrorMode FindResourceExA FindResourceA LoadResource LockResource GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetVersion WaitForSingleObject ExitProcess GetCurrentProcess DuplicateHandle GetThreadContext VirtualProtectEx WriteProcessMemory FlushInstructionCache SetThreadContext ResumeThread DeleteFileA RemoveDirectoryA AddAtomA WritePrivateProfileStringA GetAtomNameA lstrlenW CreateProcessA

user32

MoveWindow EndDialog LoadIconA GetDlgItem SendMessageA SetDlgItemTextA SetWindowLongA DialogBoxIndirectParamA CharUpperA WaitForInputIdle wsprintfA GetWindowRect GetWindowLongA ShowWindow GetClassInfoExA SetWindowTextA LoadCursorA CreateWindowExA GetClassNameA GetDialogBaseUnits RegisterClassExA PostMessageA CharLowerBuffA GetDlgItemTextA SetFocus IsDlgButtonChecked CheckDlgButton BeginPaint EndPaint FillRect ScreenToClient GetParent GetWindow SystemParametersInfoA MapWindowPoints SetWindowPos GetWindowTextLengthA GetWindowTextA GetWindowPlacement SendDlgItemMessageA DefWindowProcA GetPropA EnableMenuItem SetPropA RemovePropA IsWindow GetSysColor IsDialogMessageA TranslateMessage LoadImageA CreateDialogParamA GetDC ReleaseDC MessageBoxA GetMessageA DispatchMessageA MsgWaitForMultipleObjects PeekMessageA CharNextA PostThreadMessageA LoadStringA SetActiveWindow DestroyWindow CreateDialogIndirectParamA SetForegroundWindow GetClientRect EnableWindow IsWindowEnabled GetDesktopWindow SetWindowRgn GetWindowDC UpdateWindow InvalidateRect DrawIcon MapDialogRect DrawFocusRect InflateRect DrawTextA CopyRect EnumChildWindows IntersectRect CallWindowProcA

gdi32

CreateCompatibleBitmap CreateDCA GetStockObject GetTextExtentPoint32A CreatePatternBrush DeleteMetaFile SetMetaFileBitsEx SetStretchBltMode SelectClipRgn SetPixel PatBlt PlayMetaFile StretchBlt CreateBitmap SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx CreateDIBitmap SaveDC SetBkMode SetTextColor TextOutA RestoreDC GetTextExtentPointA CreateFontIndirectA SetBkColor CreateRectRgn DeleteObject CreateSolidBrush GetDIBColorTable GetSystemPaletteEntries CreatePalette CreateHalftonePalette GetDeviceCaps GetObjectA CreateCompatibleDC UnrealizeObject SelectPalette RealizePalette SelectObject BitBlt DeleteDC SetMapMode

advapi32

RegCloseKey OpenThreadToken RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegDeleteKeyA RegOpenKeyA RegCreateKeyA RegQueryValueA FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken

shell32

ShellExecuteExA SHGetPathFromIDListA SHGetSpecialFolderLocation SHBrowseForFolderA SHGetMalloc

ole32

StringFromGUID2 CoTaskMemAlloc CoMarshalInterThreadInterfaceInStream CoReleaseMarshalData CoInitialize CoGetInterfaceAndReleaseStream CoCreateInstance CoCreateGuid StringFromCLSID CoTaskMemFree GetRunningObjectTable CoRegisterClassObject CoRevokeClassObject CoUninitialize

oleaut32

SysAllocStringLen SysAllocString SysStringLen SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SysFreeString VariantChangeType GetErrorInfo LoadTypeLi RegisterTypeLi LoadRegTypeLi VariantClear VariantCopy SysReAllocStringLen

lz32

LZCopy LZOpenFileA LZClose

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA