624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b

General

Target
624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b
Size 160KB
Sample260822-v2nbfaam81
SHA256 624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b
MD5 3718a1c9185e0e37d67b6300fb9a12c6
SHA1 bdb5229335b5bae2ac1f63256a434a2646f973a2
SHA512 72c48402c503d33eac64e4aff1baf018a2077cf3dbd57246c8fdd9d794220221edfbfc8981f51e10e4d448f385975f9b1350cc398521c1156842d57de97c7fa2
SSDEEP 1536:Jc7O4ajA88ugoK4B+Rwd/NHhxHx5vcMBCTETW:Jc7O4aAoKMa8/NHhxHx50MBC
TLSH
T19BF374111ADE98F4D17A8FF519FB9F921E3938030FE586CB0724E55C2DB5AD0AAB0352
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b

File Explorer

624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b

.dll 160KB

624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b

IMPHASH 42d0ec3de92a8bb3f5c366f5dde0e9f9
SHA256 624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b
MD5 3718a1c9185e0e37d67b6300fb9a12c6
SHA1 bdb5229335b5bae2ac1f63256a434a2646f973a2
SHA512 72c48402c503d33eac64e4aff1baf018a2077cf3dbd57246c8fdd9d794220221edfbfc8981f51e10e4d448f385975f9b1350cc398521c1156842d57de97c7fa2
SSDEEP 1536:Jc7O4ajA88ugoK4B+Rwd/NHhxHx5vcMBCTETW:Jc7O4aAoKMa8/NHhxHx50MBC
TLSH
T19BF374111ADE98F4D17A8FF519FB9F921E3938030FE586CB0724E55C2DB5AD0AAB0352
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

16432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

ord413 InitCommonControls ord412 ord410

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow

advapi32

CredEnumerateW CredFree CredWriteW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp free fwrite getenv memcpy memmove memset strchr strcmp strcpy strcspn strlen wcschr wcsrchr

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar RaiseException SizeofResource lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

316B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

4KB

Virtual Size

564B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

624ef1570fe7b3dd4f9403934b1514e0a5d4fb38535416a93063dbde7b42444b

comctl32

user32

advapi32

ucrtbase

kernel32

ntdll

generic