ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96

Sharing

Copy URL Twitter E-mail

General

Target
ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96
Size 92KB
Sample260820-ec33lassdz
SHA256 ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96
MD5 587ddeb8867ae5caaad48a9f6fe5c449
SHA1 baab4e3bf49e6f05232c5d46c3bc8c863404bdb8
SHA512 83ea6f8198a74763ae5e6d1863486aad50dd61515c1670eac606f8e5821ed0e76ba3ae3b12b2b810e7bdf1a5304b9208ef4762d05c2bb531c2137ce7cb305e5c
SSDEEP 1536:I8JVgyiUnNyU8B9isYSQDJs19vp8jONYOWrEgY+Hw0e6ob9bdl0GWx7obItGtN0R:I+FiUUU+4sY1aH8WDW6F0e6I01dvIN0R
TLSH
T135933B05F79765DCC51AC13482A7A672B676FC2A0231AF3F6694FE306D11E902E3CE58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96

File Explorer

ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96

.dll 92KB

ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96

IMPHASH c873528e7d74f09deba82f1238a52724
SHA256 ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96
MD5 587ddeb8867ae5caaad48a9f6fe5c449
SHA1 baab4e3bf49e6f05232c5d46c3bc8c863404bdb8
SHA512 83ea6f8198a74763ae5e6d1863486aad50dd61515c1670eac606f8e5821ed0e76ba3ae3b12b2b810e7bdf1a5304b9208ef4762d05c2bb531c2137ce7cb305e5c
SSDEEP 1536:I8JVgyiUnNyU8B9isYSQDJs19vp8jONYOWrEgY+Hw0e6ob9bdl0GWx7obItGtN0R:I+FiUUU+4sY1aH8WDW6F0e6I01dvIN0R
TLSH
T135933B05F79765DCC51AC13482A7A672B676FC2A0231AF3F6694FE306D11E902E3CE58
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextA CryptDestroyKey CryptImportKey

bcrypt

BCryptEncrypt

crypt32

CertAddCertificateContextToStore CertAddEncodedCertificateToStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertOpenStore CertSetCertificateContextProperty CryptDecodeObjectEx CryptImportPublicKeyInfoEx2 CryptStringToBinaryA

kernel32

CloseHandle CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection FlushInstructionCache FreeLibrary GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemDirectoryW GetSystemInfo GetThreadContext GlobalAlloc HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MultiByteToWideChar OpenThread ResumeThread SetThreadContext Sleep SuspendThread Thread32First Thread32Next TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _errno _initterm _lock _stricmp _unlock _wcsicmp abort atoi calloc fclose fgets fopen fputc fputwc free fwprintf fwrite localeconv malloc memchr memcpy memmove memset realloc strchr strerror strlen strncmp strncpy strrchr strstr vfprintf wcscpy wcslen wcsncat wcsstr

secur32

AcceptSecurityContext AcquireCredentialsHandleA DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer QueryContextAttributesA

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

ws2_32

WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo getsockname inet_addr listen ntohs recv select send socket

CloseDriver DefDriverProc DriverCallback DrvGetModuleHandle GetDriverModuleHandle NotifyCallbackData OpenDriver PlaySound PlaySoundA PlaySoundW SendDriverMessage WOW32DriverCallback WOW32ResolveMultiMediaHandle WOWAppExit aux32Message auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joy32Message joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mci32Message mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc mid32Message midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRename mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mod32Message mxd32Message sndPlaySoundA sndPlaySoundW tid32Message timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite wid32Message wod32Message

Name

.text

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ceb2ee88daf8bae73d7b6f1ce6c87b9e9429c5119f14fb493f43733930417b96

advapi32

bcrypt

crypt32

kernel32

msvcrt

secur32

winhttp

ws2_32

generic