f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37

Sharing

Copy URL Twitter E-mail

General

Target
f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37
Size 12.1MB
Sample260820-mfajfsvcrd
SHA256 f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37
MD5 4e9da793ea91736f8adb824aa674afd5
SHA1 2cceee09f3605e02020bf88388e8415bc5718a2a
SHA512 e2cfa9f6c6da55c9c9c895caa4507a95de1237bcc3077a6be3453cf11e6a3fd43d30be5449d769f2eff771c370b20c8ae90ad8d701237d6e46eae482b604e75a
SSDEEP 196608:4a8f6ZRIrrhygwmXNXT5YZxIxyn9J3gWdIOGffyXTLjD7rCt84l:af6ZgIglFTSZxI8nv36XCTLjQ8I
TLSH
T125D633CB04AF60FAE5CE1CF48327FE9A33B37BA255845CB569C834C56C11EE0A099656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37

File Explorer

f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37

.exe 12.1MB

f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37

IMPHASH c18c6a8adfd30a2ce6d44353a3173bdc
SHA256 f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37
MD5 4e9da793ea91736f8adb824aa674afd5
SHA1 2cceee09f3605e02020bf88388e8415bc5718a2a
SHA512 e2cfa9f6c6da55c9c9c895caa4507a95de1237bcc3077a6be3453cf11e6a3fd43d30be5449d769f2eff771c370b20c8ae90ad8d701237d6e46eae482b604e75a
SSDEEP 196608:4a8f6ZRIrrhygwmXNXT5YZxIxyn9J3gWdIOGffyXTLjD7rCt84l:af6ZgIglFTSZxI8nv36XCTLjQ8I
TLSH
T125D633CB04AF60FAE5CE1CF48327FE9A33B37BA255845CB569C834C56C11EE0A099656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22515113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

rasapi32

RasHangUpA RasGetConnectStatusA

winmm

midiStreamClose PlaySoundA waveOutUnprepareHeader waveOutPrepareHeader midiStreamStop midiOutReset waveOutWrite midiStreamRestart waveOutPause waveOutReset waveOutClose midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs

ws2_32

WSACleanup WSAStartup gethostbyname inet_ntoa inet_addr gethostname select send WSAAsyncSelect htons bind socket recvfrom ioctlsocket connect recv listen getpeername accept WSAGetLastError __WSAFDIsSet ntohs getsockname shutdown closesocket

msvfw32

DrawDibDraw

avifil32

AVIStreamInfoA AVIStreamGetFrame

kernel32

CreateFileMappingA LocalFree TerminateThread UnmapViewOfFile FormatMessageA GetSystemDirectoryA GetWindowsDirectoryA GetCurrentProcess Process32Next Process32First CreateToolhelp32Snapshot SetFilePointer GetFileSize TerminateProcess OpenProcess GetVersion GetTempFileNameA InterlockedIncrement InterlockedDecrement FileTimeToLocalFileTime lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile MapViewOfFile GetThreadLocale lstrcmpiA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind ExitThread GetSystemTime GetLocalTime RaiseException HeapSize GetACP SetStdHandle GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetLastError GetTimeZoneInformation FileTimeToSystemTime CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile RemoveDirectoryA GetModuleFileNameA GetCurrentProcessId GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc MultiByteToWideChar WideCharToMultiByte GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose GetFileAttributesA DeleteFileA CreateDirectoryA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep LoadLibraryA FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers VirtualQuery

user32

CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions CharNextA SetWindowContextHelpId MapDialogRect LoadStringA GetSysColorBrush GetNextDlgGroupItem PostThreadMessageA RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC CharUpperA GetWindowTextLengthA DrawStateA FrameRect GetNextDlgTabItem GetWindowTextA FindWindowExA GetDlgItem FindWindowA GetClassNameA GetDesktopWindow GetForegroundWindow SetWindowTextA LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID MoveWindow EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage GetWindowThreadProcessId IsWindowEnabled EnumWindows IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect InvertRect IsRectEmpty ScrollDC ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBeep MessageBoxA ReleaseCapture GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle GetSubMenu GetScrollPos GetSysColor UnregisterClassA

gdi32

GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn PathToRegion EndPath BeginPath GetWindowOrgEx GetViewportOrgEx GetWindowExtEx GetDIBits RealizePalette SelectPalette StretchBlt CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetBkColor GetROP2 GetClipRgn GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA FillRgn CreateBrushIndirect SetStretchBltMode CreateHatchBrush CreateBitmap CreatePatternBrush ExtCreateRegion SelectObject SetPixel GetObjectA CreateRectRgnIndirect SetBkColor CreatePen TextOutA SetBkMode SetTextColor SetDIBitsToDevice SaveDC RestoreDC SetPolyFillMode SetROP2 SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible ExtTextOutA Escape GetTextMetricsA GetMapMode PatBlt CreateRectRgn CombineRgn CreateSolidBrush GetStockObject CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt GetPixel CreateCompatibleDC SetPixelV Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect Pie Chord Arc Polygon GetTextExtentPoint32A CreateDIBSection GetDeviceCaps

winspool.drv

OpenPrinterA ClosePrinter DocumentPropertiesA

comdlg32

ChooseColorA GetOpenFileNameA GetSaveFileNameA GetFileTitleA

advapi32

RegQueryValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegCreateKeyExA

shell32

SHGetSpecialFolderPathA ShellExecuteA Shell_NotifyIconA

ole32

CoGetClassObject CoTaskMemAlloc CLSIDFromProgID OleInitialize CoCreateInstance OleUninitialize CLSIDFromString StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoTaskMemFree

oleaut32

SafeArrayCreate UnRegisterTypeLi RegisterTypeLi LoadTypeLi OleCreateFontIndirect SysFreeString SafeArrayGetElemsize SysAllocStringByteLen SysAllocStringLen SysStringLen VariantTimeToSystemTime SysAllocString SafeArrayGetUBound VariantChangeType SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetDim SafeArrayGetLBound VariantClear VariantCopy

comctl32

ImageList_Destroy _TrackMouseEvent ord17

oledlg

ord8

wininet

InternetOpenA InternetConnectA InternetCloseHandle InternetSetOptionA InternetCanonicalizeUrlA InternetCrackUrlA HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetReadFile

Name

.text

Size

Virtual Size

994KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

443KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

..0

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

..1

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

..2

Size

12.0MB

Virtual Size

12.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

140KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f6210bdd570eb3401211f3ad12c3e45c95737caa111e4dabd863ab3e7320ba37

rasapi32

winmm

ws2_32

msvfw32

avifil32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

generic