aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3

Sharing

Copy URL Twitter E-mail

General

Target
aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3
Size 448KB
Sample260820-vhsrtafq5v
SHA256 aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3
MD5 b294adcf9572e0bec727857cb661a2e4
SHA1 30d8e8f438d7802068169152b7f0059f28815176
SHA512 774f9d010c5ebc9132954ea7f6b7f5c6e640039daf754fa0b51f4aaa2abac9adca5d2304b551b468bc4d115bdd0653c8bc15a207d8c65255866370bfd5dfa8b1
SSDEEP 12288:Powz/cwVBgmsONOOOuwHiPwHcdvt4KidLpH3nXH3H3nX+ueO:PowzkwVB1sONOOOuwHiPCNpH3nXH3H3n
TLSH
T1A2A45C17FB4357B2D02F9A3935C7E77F823CAA35955ACC52EB84DE843C638D19508286
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3

File Explorer

aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3

.dll 448KB

aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3

IMPHASH 3b855375ffb1a84e6932d32e9165f782
SHA256 aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3
MD5 b294adcf9572e0bec727857cb661a2e4
SHA1 30d8e8f438d7802068169152b7f0059f28815176
SHA512 774f9d010c5ebc9132954ea7f6b7f5c6e640039daf754fa0b51f4aaa2abac9adca5d2304b551b468bc4d115bdd0653c8bc15a207d8c65255866370bfd5dfa8b1
SSDEEP 12288:Powz/cwVBgmsONOOOuwHiPwHcdvt4KidLpH3nXH3H3nX+ueO:PowzkwVB1sONOOOuwHiPCNpH3nXH3H3n
TLSH
T1A2A45C17FB4357B2D02F9A3935C7E77F823CAA35955ACC52EB84DE843C638D19508286
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyA RegOpenKeyW RegQueryValueExW

gdi32

AbortPath ArcTo BitBlt CombineRgn CreateBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreatePatternBrush CreatePolygonRgn CreateRectRgn CreateSolidBrush DPtoLP DeleteDC DeleteEnhMetaFile DeleteObject EnumEnhMetaFile ExtCreateRegion ExtEscape GdiDeleteSpoolFileHandle GdiGetDevmodeForPage GdiGetSpoolFileHandle GdiGradientFill GetArcDirection GetBkColor GetBkMode GetCurrentObject GetCurrentPositionEx GetDCBrushColor GetDCPenColor GetDeviceCaps GetFontData GetGlyphIndicesW GetGraphicsMode GetLayout GetMapMode GetObjectA GetObjectType GetObjectW GetOutlineTextMetricsA GetPaletteEntries GetPath GetPolyFillMode GetROP2 GetRandomRgn GetRasterizerCaps GetRegionData GetRgnBox GetStockObject GetTextAlign GetTextCharacterExtra GetTextColor GetTextExtentPointW GetTextMetricsW GetTransform GetWorldTransform LPtoDP MoveToEx OffsetRgn PatBlt PlayEnhMetaFileRecord ResetDCW ScriptFreeCache ScriptItemize ScriptLayout ScriptShape SelectObject SetArcDirection SetBkColor SetBkMode SetBrushOrgEx SetDIBits SetDIBitsToDevice SetEnhMetaFileBits SetGraphicsMode SetMapMode SetPolyFillMode SetROP2 SetRectRgn SetStretchBltMode SetTextAlign SetTextColor SetTextJustification SetWorldTransform

kernel32

CloseHandle CreateFileMappingW CreateFileW DelayLoadFailureHook DisableThreadLibraryCalls GetFileSizeEx GetLocaleInfoW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LocalAlloc LocalFree MapViewOfFile MulDiv MultiByteToWideChar ResolveDelayLoadedAPI UnmapViewOfFile WideCharToMultiByte

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _create_locale _errno _findclose _free_locale _strdup _stricmp _wcsdup _wcsicmp _wfindfirst32 _wfindnext32 _wfopen atan2 bsearch calloc cos fclose feof fgetc fgets floor free ftell fwrite getenv isprint isspace isxdigit malloc memcpy memmove memset qsort realloc rewind sin strchr strcmp strcpy strcspn strerror strlen strncmp strpbrk strstr strtod toupper wcschr wcscmp wcscpy wcslen

user32

CheckRadioButton GetDlgItem GetParent GetWindowLongW IntersectRect LoadStringW SendDlgItemMessageA SendDlgItemMessageW SendMessageW SetWindowLongW ShowWindow UnionRect

win32u

NtGdiGetOutlineTextMetricsInternalW NtGdiGetTextExtentExW

Name

.text

Size

160KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

508B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

192KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aca36875bd60fa50a70c813a0d8ca64bb2fce903a5f8f2722c346921a854f1f3

advapi32

gdi32

kernel32

ntdll

ucrtbase

user32

win32u

generic