6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721

Sharing

Copy URL Twitter E-mail

General

Target
6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721
Size 51KB
Sample260819-j7261asscx
SHA256 6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721
MD5 a64c8b1a143aec29930ee3bd13f5de4d
SHA1 41f2996fecacd4a037f3a6cf2f1e6b2ed5659253
SHA512 0e1f3d120f1cd6185659642bb5623e920e083cb505ac7f7730da59149c72d3fcd65f3f7349aaa6a2d6e3aff3f9009d3417009e44a448168942d51a8195f66153
SSDEEP 768:MonToIf1TBRWoQxZpWezNOsWXccdCD9vmP7d98JzGET1cJ:MonToIfB3C0epOsWXccd4MApcJ
TLSH
T185331941B6E8C892F17F4B319CF1C9545A667C508FA2CD6B3184AF5F19B4290AB20FB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721

File Explorer

6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721

.dll 51KB

6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721

IMPHASH 018791476d00eea37aef18b2d5ad8e93
SHA256 6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721
MD5 a64c8b1a143aec29930ee3bd13f5de4d
SHA1 41f2996fecacd4a037f3a6cf2f1e6b2ed5659253
SHA512 0e1f3d120f1cd6185659642bb5623e920e083cb505ac7f7730da59149c72d3fcd65f3f7349aaa6a2d6e3aff3f9009d3417009e44a448168942d51a8195f66153
SSDEEP 768:MonToIf1TBRWoQxZpWezNOsWXccdCD9vmP7d98JzGET1cJ:MonToIfB3C0epOsWXccd4MApcJ
TLSH
T185331941B6E8C892F17F4B319CF1C9545A667C508FA2CD6B3184AF5F19B4290AB20FB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress FreeLibrary WinExec Process32First TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32Next GetPriorityClass lstrcatA GetModuleHandleW GetComputerNameA Sleep GetModuleFileNameA WriteFile SetThreadPriority CreateFileA GetCurrentThread QueryPerformanceFrequency GetSystemInfo CreateThread GetThreadContext GetFileSize GlobalMemoryStatusEx GetDiskFreeSpaceExA LoadLibraryA GetTickCount CopyFileA CreateFileW DecodePointer GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetStdHandle GetStringTypeW SetFilePointerEx GetProcessHeap LCMapStringW LoadLibraryExW GetModuleHandleA GetCurrentThreadId GetCurrentProcess lstrcpynA FileTimeToLocalFileTime lstrcpyA DeleteFileA FileTimeToSystemTime QueryPerformanceCounter GetLastError lstrcmpA FindClose FindNextFileA GetDriveTypeA FindFirstFileA MoveFileA ReadFile CreateProcessA VirtualProtect CloseHandle CreatePipe SetUnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetFileType GetStdHandle GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent RtlUnwind RaiseException InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ExitProcess GetModuleHandleExW GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc WriteConsoleW

user32

SetProcessWindowStation OpenDesktopA OpenWindowStationA GetThreadDesktop GetProcessWindowStation SendMessageA CreateWindowExA IsWindow CloseWindow GetDesktopWindow wsprintfA SetThreadDesktop GetSystemMetrics ExitWindowsEx mouse_event SetCursorPos SendInput

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC SetStretchBltMode DeleteObject CreateDCA

advapi32

RegCloseKey LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegQueryValueExA GetUserNameA OpenProcessToken

shell32

SHGetFileInfoA ShellExecuteA

avicap32

capGetDriverDescriptionA capCreateCaptureWindowA

ws2_32

WSAGetLastError setsockopt recv send WSAIoctl htons connect socket inet_addr shutdown gethostbyname closesocket

Name

.text

Size

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6665b2398b6e7ed9e3e4d6ca09140e6171081952106e6d3f3ca1729d3094b721

kernel32

user32

gdi32

advapi32

shell32

avicap32

ws2_32

generic