ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4

Sharing

Copy URL Twitter E-mail

General

Target
ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4
Size 853KB
Sample260822-e7vppseq7v
SHA256 ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4
MD5 a38dd8e4a61e67254aca8fead57c7a6c
SHA1 63d5e0d83aa71f6cca6d74410629493f16c151f7
SHA512 aec56e55dd344f6865cc8d6989e060fb8fb5b6ad2aa963779fb1aa6c3a66ab12a72c3ab2504a59c621681123c05238bbbb60bcda4dbb9ce0aa192c5e0b051008
SSDEEP 12288:L0eUXSjz+wkutYpuTaJx7Z+/+W4l0F+eUDMuonsXM:L0S2ZuSpuTaJ1Z+/+W1F+esH8
TLSH
T110058D5BE9A911ADE06BC078C9EB5516F7717C1A076096EB03D09A6A3F33BD0473EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4

File Explorer

ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4

.dll 853KB

ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4

IMPHASH a830a24ca6ae637c290f0113c3647760
SHA256 ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4
MD5 a38dd8e4a61e67254aca8fead57c7a6c
SHA1 63d5e0d83aa71f6cca6d74410629493f16c151f7
SHA512 aec56e55dd344f6865cc8d6989e060fb8fb5b6ad2aa963779fb1aa6c3a66ab12a72c3ab2504a59c621681123c05238bbbb60bcda4dbb9ce0aa192c5e0b051008
SSDEEP 12288:L0eUXSjz+wkutYpuTaJx7Z+/+W4l0F+eUDMuonsXM:L0S2ZuSpuTaJ1Z+/+W1F+esH8
TLSH
T110058D5BE9A911ADE06BC078C9EB5516F7717C1A076096EB03D09A6A3F33BD0473EB01
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

477780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Work\MonitorV3_Other\x64\Release\SystemUIExt.pdb

kernel32

FindFirstFileW FindNextFileW WriteFile FindClose CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW GetLocalTime GetFileSize InitializeCriticalSectionEx MultiByteToWideChar GetLastError DecodePointer DeleteCriticalSection WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS WaitForSingleObjectEx SetThreadPriority SetEndOfFile ReadFile ReadConsoleW SetStdHandle HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetTickCount64 CreateProcessW GetCurrentProcessId CreateThread CloseHandle Process32FirstW OutputDebugStringW DisableThreadLibraryCalls Process32NextW Sleep CreateToolhelp32Snapshot WriteConsoleW GetModuleFileNameW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation GetFileType GetStdHandle HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue RtlUnwind FlsGetValue FlsAlloc SetLastError InterlockedFlushSList LocalFree QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx SleepConditionVariableSRW WakeAllConditionVariable RtlPcToFileHeader RaiseException EncodePointer LCMapStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlLookupFunctionEntry RtlUnwindEx

user32

GetCursorInfo TranslateMessage SetWindowsHookExW ToUnicode GetMonitorInfoW OpenInputDesktop GetUserObjectInformationW ReleaseDC GetForegroundWindow DispatchMessageW GetKeyboardState GetShellWindow CallNextHookEx GetMessageW GetWindowTextLengthW GetWindowTextW UnhookWindowsHookEx CloseDesktop MonitorFromPoint GetLastInputInfo GetDC EnumDisplayMonitors GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject BitBlt

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW GetUserNameW

shell32

SHChangeNotify SHCreateDirectoryExW

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

SHDeleteKeyW

ws2_32

WSACleanup accept bind closesocket listen WSAStartup htons recv socket send

wininet

InternetOpenW InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA HttpQueryInfoW

Name

.text

Size

642KB

Virtual Size

642KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ece02660a1442a819a2310836c97e4403d3b714e387f884105cf6e81ddbf90c4

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wininet

generic