3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484

Sharing

Copy URL Twitter E-mail

General

Target
3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484
Size 786KB
Sample260818-nv7ceasxes
SHA256 3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484
MD5 af9eeaab6dfc11c454d76969af42737f
SHA1 b04871ea0d5c0446a083dbe14c24725af4e5bfec
SHA512 70897481f8839b8590c6d1dffb4810e5cebf0460dc6cd22b6d2ed6bfe5cfbf138ff531278e6cdc6144fb4b9f90232a012fb3fde0de3f1fb1696fdc5f7475f472
SSDEEP 24576:C+b1b0R7nvwdz31MhHzAVvMMMMMMMMXeeerrrrrz84I4JMO7:Xutvwdz31yTA4
TLSH
T1D305180136E95279F1F31BB05A79AB690479BC358F11C6DF2294661E0C31AE1EE31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484

File Explorer

3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484

.exe 786KB

3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484

IMPHASH 87f8d35d0c8fb355b72111b6283b9997
SHA256 3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484
MD5 af9eeaab6dfc11c454d76969af42737f
SHA1 b04871ea0d5c0446a083dbe14c24725af4e5bfec
SHA512 70897481f8839b8590c6d1dffb4810e5cebf0460dc6cd22b6d2ed6bfe5cfbf138ff531278e6cdc6144fb4b9f90232a012fb3fde0de3f1fb1696fdc5f7475f472
SSDEEP 24576:C+b1b0R7nvwdz31MhHzAVvMMMMMMMMXeeerrrrrz84I4JMO7:Xutvwdz31yTA4
TLSH
T1D305180136E95279F1F31BB05A79AB690479BC358F11C6DF2294661E0C31AE1EE31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

288408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\001_WorkCode\panda_pictorial\PandaPictorialBuild\webview2.pdb

webview2loader

CreateCoreWebView2EnvironmentWithOptions GetAvailableCoreWebView2BrowserVersionString

kernel32

GetModuleHandleExW GetProcAddress LoadResource LockResource SizeofResource FindResourceW FormatMessageW lstrcpynW WideCharToMultiByte CreateFileW GetFileSize ReadFile SetFilePointer GetExitCodeProcess EnterCriticalSection LeaveCriticalSection OpenProcess GetCommandLineW GetCurrentProcess FreeLibrary LoadLibraryExW LoadLibraryW lstrcmpiW MultiByteToWideChar InitializeCriticalSection SetEvent CreateEventW WaitForMultipleObjects RegisterWaitForSingleObject UnregisterWait GetFileSizeEx GetLocalTime UnmapViewOfFile ReleaseSemaphore DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError GetLastError RaiseException WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleW GetOEMCP GetACP IsValidCodePage FindFirstFileExW FindClose SetFilePointerEx ReadConsoleW GetModuleFileNameW GetModuleFileNameA CloseHandle DecodePointer OutputDebugStringW DebugBreak FindNextFileW IsDebuggerPresent FindResourceExW SetEndOfFile GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale QueryPerformanceCounter GetStartupInfoW ResetEvent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter lstrcmpA DeviceIoControl FreeResource GetVersionExW GetSystemWindowsDirectoryW Sleep InterlockedExchangeAdd FlushFileBuffers WriteFile LoadLibraryExA VirtualFree VirtualAlloc GetFileType GetCurrentThreadId GetCurrentProcessId GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LocalFree CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject GetCommandLineA ReleaseMutex GetStringTypeW GetCPInfo EncodePointer InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent

user32

GetClientRect RegisterWindowMessageW SendMessageW PostMessageW UnregisterClassW SetWindowPos DefWindowProcW CopyRect GetWindowLongW SetWindowLongW RegisterClassExW LoadCursorW PostQuitMessage CallWindowProcW IsWindow DestroyWindow ShowWindow SetTimer BeginPaint EndPaint FindWindowW SetWindowTextW SendMessageTimeoutW CharNextW DispatchMessageW TranslateMessage GetMessageW GetClassInfoExW GetWindowThreadProcessId CreateWindowExW

advapi32

RegEnumKeyExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey OpenProcessToken GetTokenInformation RegQueryValueExW

shell32

ShellExecuteExW SHCreateDirectoryExW SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitializeSecurity CoSetProxyBlanket CoCreateGuid OleUninitialize OleInitialize CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoInitializeEx CoTaskMemFree

oleaut32

SysAllocString SysFreeString SysStringLen VariantClear VariantCopy VarUI4FromStr VariantInit VariantChangeType SysAllocStringLen

shlwapi

PathRemoveFileSpecW PathFindFileNameW PathAppendW PathFindExtensionW SHGetValueW PathCombineW StrCmpNIW StrTrimA StrStrIA PathFileExistsW StrStrIW StrCmpIW ord12

comctl32

InitCommonControlsEx

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

bcrypt

BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptGetProperty BCryptDestroyHash BCryptOpenAlgorithmProvider BCryptFinishHash

iphlpapi

GetAdaptersInfo

Sharing

General

Malware Config

Signatures

File Explorer

3f75677e9052df1a65b2aa0e60aee14768cd68970d5bcdd05a427870f2dfc484

webview2loader

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

version

bcrypt

iphlpapi

generic