01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d

Sharing

Copy URL Twitter E-mail

General

Target
01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d
Size 265KB
Sample260818-tfcgdaaa93
SHA256 01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d
MD5 6082efcfb311e3a78e9ae83079a286b0
SHA1 de7acb34675a1f72ccc9a7dcf1424a98e50037f1
SHA512 e4ab5578e36f060ae97076327e3c039e99ca8a21b5e218f9fd5c1f91161345225330dea1d4857d05bb4cc14ea7bab2929dd153b239d00e8ba6b1b216499088a8
SSDEEP 3072:jQCynVuVpKUPsdYhslr3JFfENqN/41lASdAyR1f0kTGqpvT:jQHVwKUPsVlr3JFfENqNg1lASdAyRyET
TLSH
T1EE443B1CF787B8A0F4BF857415ABF77E82287C10AB61EE279E146D5D5D3A9B2C021B01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d

File Explorer

01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d

.dll 265KB

01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d

IMPHASH 3ed02955d77c63fbc3f3c2b6c73cd8ec
SHA256 01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d
MD5 6082efcfb311e3a78e9ae83079a286b0
SHA1 de7acb34675a1f72ccc9a7dcf1424a98e50037f1
SHA512 e4ab5578e36f060ae97076327e3c039e99ca8a21b5e218f9fd5c1f91161345225330dea1d4857d05bb4cc14ea7bab2929dd153b239d00e8ba6b1b216499088a8
SSDEEP 3072:jQCynVuVpKUPsdYhslr3JFfENqN/41lASdAyR1f0kTGqpvT:jQHVwKUPsVlr3JFfENqNg1lASdAyRyET
TLSH
T1EE443B1CF787B8A0F4BF857415ABF77E82287C10AB61EE279E146D5D5D3A9B2C021B01
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

76704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls EnumResourceNamesW ExpandEnvironmentStringsW FindResourceW GetFileAttributesW GetFullPathNameW GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetProcAddress GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte lstrcmpW lstrcmpiW

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx

gdi32

CreateFontIndirectW GetObjectW GetStockObject LineTo MoveToEx SelectObject SetDCPenColor

ole32

CoCreateInstance OleCreate OleInitialize OleSetContainedObject OleUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

PathCombineW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _strdup _stricmp _strnicmp _wcsnicmp atoi free fwrite getenv isspace memchr memcmp memcpy memmove strchr strcmp strcpy strcspn strlen strncmp strstr strtol tolower wcschr wcsrchr wcsstr

user32

BeginPaint ClientToScreen CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EndPaint FrameRect GetClientRect GetDesktopWindow GetMessageW GetParent GetSubMenu GetSysColor GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextA LoadBitmapW LoadCursorW LoadIconW LoadMenuW LoadStringW MoveWindow PostQuitMessage RegisterClassExW ReleaseCapture SendMessageW SetCapture SetMenuItemInfoW SetWindowLongW SetWindowPos ShowWindow TrackPopupMenu TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

76KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

204B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

52KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

01fbbb420cf9971175a5d5abe20cdb018dd8639faf9668bfdacc060f414a472d

kernel32

comctl32

gdi32

ole32

oleaut32

shlwapi

ucrtbase

user32

generic