d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58

Sharing

Copy URL Twitter E-mail

General

Target
d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58
Size 1002KB
Sample260819-myabeascrd
SHA256 d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58
MD5 7acbfd73b4965cd74bc64be44e3e56e8
SHA1 960629b55acaddb9cb6de659c847b79122e88c08
SHA512 9175ee7982c0fdda6d630a2a56bd6432467b213300a86920993b34731be1ab8875cbfd1dcb92ada7394da03869552fe2f0aafd5a99a1d36a8f6c57b87080d122
SSDEEP 24576:7aEOIAcHi/P3RCoFBbJFgYI8HmX60heEVMuB:MGNiab6seClB
TLSH
T152254AF237C58225F9490071D63ED6BA002ACF72277591C7AB407E6E6A60DC12AFB717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58

File Explorer

d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58

.dll 1002KB

d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58

IMPHASH d2721915cc9d1694586670728dea1cae
SHA256 d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58
MD5 7acbfd73b4965cd74bc64be44e3e56e8
SHA1 960629b55acaddb9cb6de659c847b79122e88c08
SHA512 9175ee7982c0fdda6d630a2a56bd6432467b213300a86920993b34731be1ab8875cbfd1dcb92ada7394da03869552fe2f0aafd5a99a1d36a8f6c57b87080d122
SSDEEP 24576:7aEOIAcHi/P3RCoFBbJFgYI8HmX60heEVMuB:MGNiab6seClB
TLSH
T152254AF237C58225F9490071D63ED6BA002ACF72277591C7AB407E6E6A60DC12AFB717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

440283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Project\ZipApp\ImageShow\Output\Bin\Release\Win32\InstallModule.pdb

kernel32

TerminateProcess WriteConsoleW FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetConsoleOutputCP SetStdHandle ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsGetValue ExitProcess FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedFlushSList RtlUnwind LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList CreateThread GetCPInfo LCMapStringEx EncodePointer QueryPerformanceFrequency GetStringTypeW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateThread WaitForSingleObject InitializeCriticalSection FindClose FindNextFileW GetFileSizeEx SetEndOfFile ReadFile LocalFree GetCurrentProcess GetModuleHandleExW FlsAlloc GetTickCount CloseHandle WriteFile CreateFileW MulDiv GetCurrentProcessId FreeResource GlobalFree GlobalAlloc VerSetConditionMask VerifyVersionInfoW WideCharToMultiByte LoadLibraryW GetModuleHandleW SetLastError GetVersion OutputDebugStringW Sleep DecodePointer GetCurrentThreadId FindResourceExW LockResource RaiseException DeleteCriticalSection InitializeCriticalSectionEx GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar GetLastError EnterCriticalSection LeaveCriticalSection lstrcmpiW GetProcAddress FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FlsSetValue

user32

TranslateMessage DispatchMessageW MessageBoxW PostMessageW IsWindow DefWindowProcW GetMessageW PeekMessageW UnregisterClassW DestroyWindow KillTimer ShowWindow SetTimer SetWindowLongW RegisterClassExW GetClassInfoExW LoadCursorW CreateWindowExW GetWindowLongW CallWindowProcW SendMessageW PostQuitMessage LoadIconW SetWindowPos MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindow SetForegroundWindow CharNextW GetDlgItem GetCursorPos PtInRect CopyRect GetCursor GetIconInfo SetRectEmpty EqualRect SetCursor ClientToScreen ScreenToClient GetDoubleClickTime IntersectRect FillRect LoadImageW DestroyIcon BeginPaint DrawTextW GetDC ReleaseDC SetWindowTextW EndPaint IsIconic TrackMouseEvent SetCapture ReleaseCapture SetWindowRgn IsWindowVisible GetWindowTextW EnableWindow GetForegroundWindow IsZoomed MonitorFromRect GetWindowTextLengthW SetFocus InvalidateRect OffsetRect SetLayeredWindowAttributes UpdateLayeredWindow GetWindowThreadProcessId AttachThreadInput BringWindowToTop SetActiveWindow UpdateWindow GetKeyState GetCaretBlinkTime CreateCaret SetCaretPos GetFocus SystemParametersInfoW MoveWindow IsRectEmpty GetSysColor RegisterClipboardFormatW IsClipboardFormatAvailable

gdi32

GetViewportOrgEx CreateFontIndirectW Rectangle CreatePen RestoreDC ExtSelectClipRgn CreateRectRgnIndirect SaveDC GetDeviceCaps SetBitmapBits SetTextCharacterExtra GetCurrentObject GetTextColor CreateRectRgn CombineRgn CreateRoundRectRgn GetStockObject SetBkColor SetTextColor SetBkMode GetBitmapBits StretchBlt SetStretchBltMode DeleteDC BitBlt SetPixel SelectObject CreateCompatibleDC CreateDIBSection CreateSolidBrush GetObjectW DeleteObject

advapi32

RegCloseKey RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegDeleteKeyW

shell32

SHBrowseForFolderW SHGetSpecialFolderLocation ShellExecuteW SHGetPathFromIDListW

ole32

CoUninitialize CoInitialize CoCreateInstance CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes RegisterDragDrop CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

LoadTypeLi SysAllocString SysStringLen LoadRegTypeLi SysFreeString VarUI4FromStr VarBstrCmp SysAllocStringByteLen SysAllocStringLen SysStringByteLen

shlwapi

PathCombineW PathFileExistsW PathAppendW

comctl32

ord17 DrawShadowText InitCommonControlsEx

msimg32

AlphaBlend

gdiplus

GdipFree GdipAlloc GdipDisposeImage GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawString GdipSetTextRenderingHint GdipCreateSolidFill GdipDeleteBrush GdipBitmapLockBits GdipCreateBitmapFromHICON GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipCreateFromHDC GdipDrawImageRectI GdipSetInterpolationMode GdipDeleteGraphics GdipGetImageGraphicsContext GdiplusStartup

Name

.text

Size

627KB

Virtual Size

627KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

126KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d5b2df23dfdfa8595cfeef4c23da560f6501f73c8e70d843465fd61b3249fe58

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

generic