c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be

Sharing

Copy URL Twitter E-mail

General

Target
c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be
Size 2.7MB
Sample260822-mk49matbma
SHA256 c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be
MD5 928c4ea28937fe38c991809e6d122840
SHA1 1457f4e98b67d628671aae01a6a6693490234182
SHA512 0261dc909c21d78ccef556a3ee3a35797f2706066af91e9fd4849a0216b9d35cda204f934400cf9fbc3afa0876a0d46d2e553b36c462af428145c7faca44bf55
SSDEEP 49152:JQNknXjMlQDbEaoc3E51tXeybcdZyU/SFYTXbohIqZFuY5cAhyiX:aXtXeybcP10YjiX
TLSH
T1D9D57D10B501C735DE12017BED6EA9AE685CAA34077895C3F2C12D6F3DF86D31A3A297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be

File Explorer

c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be

.exe 2.7MB

c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be

IMPHASH 653a9eff9c8972aee39fa85894d19290
SHA256 c56c76b82ad6b86cfa36d55e4e09ba1e64bdd486d63f00166e7249f20b1a93be
MD5 928c4ea28937fe38c991809e6d122840
SHA1 1457f4e98b67d628671aae01a6a6693490234182
SHA512 0261dc909c21d78ccef556a3ee3a35797f2706066af91e9fd4849a0216b9d35cda204f934400cf9fbc3afa0876a0d46d2e553b36c462af428145c7faca44bf55
SSDEEP 49152:JQNknXjMlQDbEaoc3E51tXeybcdZyU/SFYTXbohIqZFuY5cAhyiX:aXtXeybcP10YjiX
TLSH
T1D9D57D10B501C735DE12017BED6EA9AE685CAA34077895C3F2C12D6F3DF86D31A3A297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1711530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

soundlib

CreateSoundLib

winmm

timeGetTime

ss3dgfunc

_TransformVector3_VPTR2@16 _RotatePositionWithPivot@24 _CalcDistance@8 _MatrixMultiply2@12 _TransformV3TOV4@16 _SetInverseMatrix@8 _SetRotationXMatrix@8 _CrossProduct@12 _VECTOR3Length@4 _COLORtoDWORD@16 _WriteTGA@24 _Normalize@8 _SetRotationYMatrix@8

wsock32

inet_addr socket send WSAStartup recv WSACleanup closesocket connect htons ioctlsocket gethostbyname

dinput8

DirectInput8Create

wininet

HttpSendRequestA HttpOpenRequestA InternetQueryDataAvailable InternetConnectA InternetReadFile InternetCloseHandle InternetOpenA

kernel32

QueryPerformanceCounter IsProcessorFeaturePresent LoadLibraryExW HeapAlloc HeapFree GetProcessHeap GetModuleFileNameW OutputDebugStringW LocalFree EncodePointer GetSystemTimeAsFileTime GetFileSize CloseHandle GetLocalTime OpenFile IsDBCSLeadByte CreateDirectoryA GetTickCount DeleteFileA Sleep GlobalAlloc GlobalLock GlobalUnlock GlobalFree DecodePointer RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject ReadFile CreatePipe CreateProcessA GetStartupInfoA GetCurrentDirectoryA GetVolumeInformationA WideCharToMultiByte lstrlenA SetCurrentDirectoryA CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next lstrcmpA lstrcpyA OutputDebugStringA FreeLibrary GetProcAddress LoadLibraryA CreateFileA VerSetConditionMask InterlockedExchange InterlockedCompareExchange OpenProcess GetCurrentProcess GetCurrentProcessId ExitProcess CreateThread GetProcessId GetThreadContext IsDebuggerPresent InitializeCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent WaitForMultipleObjects DuplicateHandle lstrcmpiA lstrcatA CreateEventA GetLogicalDriveStringsA GetModuleHandleA QueryDosDeviceA GetPriorityClass VerifyVersionInfoA VirtualQuery MulDiv WriteFile FindClose RemoveDirectoryA FindFirstFileA FindNextFileA MultiByteToWideChar ResumeThread GetCurrentThreadId GetTempPathA SetFileAttributesA CopyFileA GetVersionExA GetSystemTime GetTickCount64

user32

ShowWindow CreateWindowExA RegisterClassExA DefWindowProcA UnregisterHotKey RegisterHotKey PeekMessageA DispatchMessageA TranslateMessage ReleaseDC GetDC ScreenToClient GetCursorPos SetCapture IsClipboardFormatAvailable GetClipboardData PostQuitMessage OffsetRect GetWindowThreadProcessId EnumWindows FindWindowA GetWindowTextA CopyRect PostMessageA EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CharPrevA CharNextA MessageBoxA SetRect wsprintfA GetSystemMetrics UpdateWindow ShowCursor LoadIconA SetCursor LoadCursorFromFileA GetClientRect ReleaseCapture

gdi32

GetDeviceCaps SelectObject GetTextExtentPoint32A DeleteObject CreateFontIndirectA GetStockObject

advapi32

LookupAccountSidA GetTokenInformation OpenProcessToken RegQueryValueExA RegOpenKeyExA RegCloseKey RegQueryInfoKeyA GetUserNameA

shell32

ShellExecuteA

ole32

CoInitialize CoFreeUnusedLibraries CoUninitialize CoCreateInstance

oleaut32

VariantClear

freeimage

_FreeImage_GetInfo@4 _FreeImage_GetBits@4 _FreeImage_ConvertTo16Bits565@4 _FreeImage_SaveJPEG@12 _FreeImage_Unload@4 _FreeImage_Load@12

msvcp120

?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Winerror_map@std@@YAPBDH@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Syserror_map@std@@YAPBDH@Z ?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z ?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??Bid@locale@std@@QAEIXZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Orphan_all@_Container_base12@std@@QAEXXZ ??1_Container_base12@std@@QAE@XZ ??0_Container_base12@std@@QAE@XZ ?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_BADOFF@std@@3_JB ?id@?$codecvt@DDH@std@@2V0locale@2@A ?_Swap_all@_Container_base12@std@@QAEXAAU12@@Z _Xtime_get_ticks ?uncaught_exception@std@@YA_NXZ ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??0id@locale@std@@QAE@I@Z

msvcr120

_atoi64 fputs srand _itoa_s ftell _libm_sse2_tan_precise _i64toa strcat_s _localtime64 _vsnprintf _mbsnbicmp _beginthreadex realloc toupper _CIatan2 atof sprintf_s malloc free strcpy_s strncmp memchr _time64 fopen_s _pgmptr memcpy_s feof fflush fgetc fgetpos fgets fputc fsetpos _fseeki64 setvbuf ungetc _lock_file _unlock_file ??0bad_cast@std@@QAE@PBD@Z ??0bad_cast@std@@QAE@ABV01@@Z ??0exception@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ isalpha exit _strnicmp _access _mkdir strcpy _wassert ??1type_info@@UAE@XZ ?terminate@@YAXXZ _lock _calloc_crt __dllonexit _onexit _except1 _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _except_handler4_common _XcptFilter __crtGetShowWindowMode _amsg_exit __getmainargs __set_app_type _exit _cexit _ismbblead _configthreadlocale __setusermatherr _initterm_e _initterm _acmdln _fmode _commode __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s _findclose _findfirst64i32 _findnext64i32 strncat _itoa _unlock ??3@YAXPAX@Z _libm_sse2_cos_precise _libm_sse2_sin_precise __CxxFrameHandler3 ??2@YAPAXI@Z ??_V@YAXPAX@Z memset strncpy fclose fopen fprintf _purecall rand sprintf memcpy fread fseek fwrite sscanf memmove atoi vsprintf _CxxThrowException _libm_sse2_sqrt_precise _strupr fscanf printf atol strstr strtok

psapi

GetProcessImageFileNameA

iphlpapi

GetAdaptersInfo

generic

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=225, version=20806,

count=3, id=199, version=41118,

count=9, id=223, productName=VS2013 build 21005, version=21005,

count=19, id=224, productName=VS2013 build 21005, version=21005,

count=4, id=221, productName=VS2013 build 21005, version=21005,

count=12, id=225, productName=VS2013 build 21005, version=21005,

count=2, id=25, version=9210,

count=1, id=11, version=8966,

count=3, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=7, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,

count=427, id=1, productName=Unmarked objects,

count=2, id=28, version=9178,

count=671, id=225, productName=VS2013 UPD4 build 31101, version=31101,

count=1, id=219, productName=VS2013 build 21005, version=21005,

count=1, id=151,

count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,