cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da

Sharing

Copy URL Twitter E-mail

General

Target
cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da
Size 2.1MB
Sample260822-vx2cha1zhv
SHA256 cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da
MD5 f913d7cfba2e5e7271d98fa5ef52eec4
SHA1 1e025fe1c3f5097a6a482fff61b63de7913df595
SHA512 30ff4dbc2b5cb6123ee141c9df6f86b0c03428c2529525a38eefe9f26cebcb7791906577f405b578995f5939cf3a7b037f20c21c9c25cf13d1dbfcb1cfa8a0eb
SSDEEP 49152:Y/fgl9hDn+JIBO6phTPhxTo81c8xPWVwjuCFUI0lWYDOav2QusXRgBzlgot9mn0K:jjuM++sf
TLSH
T1CCA5D6A0F193A37AD54E077018FEE52EBB706221D32399C3A7045568AFD6BE13538973
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da

File Explorer

cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da

.dll 2.1MB

cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da

IMPHASH 53178b6b4db731548861203dd6fc068d
SHA256 cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da
MD5 f913d7cfba2e5e7271d98fa5ef52eec4
SHA1 1e025fe1c3f5097a6a482fff61b63de7913df595
SHA512 30ff4dbc2b5cb6123ee141c9df6f86b0c03428c2529525a38eefe9f26cebcb7791906577f405b578995f5939cf3a7b037f20c21c9c25cf13d1dbfcb1cfa8a0eb
SSDEEP 49152:Y/fgl9hDn+JIBO6phTPhxTo81c8xPWVwjuCFUI0lWYDOav2QusXRgBzlgot9mn0K:jjuM++sf
TLSH
T1CCA5D6A0F193A37AD54E077018FEE52EBB706221D32399C3A7045568AFD6BE13538973
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

940576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

AsyncInstallDistributionUnit CoInternetCombineUrlEx CoInternetCreateSecurityManager CoInternetParseIUri CoInternetParseUrl CreateAsyncBindCtx CreateIUriBuilder CreateURLMoniker CreateURLMonikerEx2 CreateUri FindMimeFromData ord445 RegisterBindStatusCallback ReleaseBindInfo

shlwapi

AssocQueryStringW DelayLoadFailureHook ord329 PathCanonicalizeW UrlUnescapeW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW ShellExecuteW

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoGetClassObject CoTaskMemAlloc CoTaskMemFree CreateBindCtx CreateOleAdviseHolder ProgIDFromCLSID

oleaut32

DispCallFunc LoadRegTypeLib LoadTypeLibEx SafeArrayAccessData SafeArrayCreate SafeArrayDestroy SafeArrayPutElement SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarI4FromStr VariantChangeType VariantChangeTypeEx VariantClear VariantCopy VariantInit

user32

BeginPaint CallWindowProcW CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DialogBoxParamW DrawEdge EndDialog EndPaint GetClientRect GetDC GetDesktopWindow GetDlgItem GetFocus GetParent GetPropW GetSubMenu GetSystemMetrics GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsWindowVisible KillTimer LoadMenuW LoadStringW MapWindowPoints MessageBoxW PostMessageW RedrawWindow RegisterClassExW ReleaseDC SendMessageW SetFocus SetParent SetPropW SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfW

gdi32

GetDeviceCaps

advapi32

RegCloseKey RegEnumKeyW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExA RegQueryValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _stricmp _strlwr _strnicmp _wcsdup _wcsicmp _wcslwr _wcsnicmp _wgetenv bsearch calloc floor free fwrite getenv iswalnum iswspace malloc memcmp memcpy memmove memset qsort realloc strchr strcmp strcpy strcspn strlen strncmp wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr wcstol wcstoul

kernel32

CloseHandle CompareStringW CreateDirectoryW CreateFileW CreateMutexW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection EnumResourceNamesW FindResourceW FreeLibrary GetACP GetDateFormatW GetEnvironmentVariableW GetFileAttributesW GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetTickCount GetUserDefaultLCID GetUserDefaultUILanguage GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce IsBadStringPtrA IsBadStringPtrW LCIDToLocaleName LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource MultiByteToWideChar RaiseException ReadFile ReleaseMutex ResolveDelayLoadedAPI SearchPathW SetEnvironmentVariableW SizeofResource TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WideCharToMultiByte WriteFile lstrcmpiW

ntdll

_aulldiv _chkstk _vsnprintf

Name

.text

Size

920KB

Virtual Size

916KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

324KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.eh_fram

Size

4KB

Virtual Size

404B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

4KB

Virtual Size

392B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

72KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

88KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cadd98d33278fbbb120c23ad40a9362759f7a7035e227ed5525f85e41a6c24da

urlmon

shlwapi

shell32

ole32

oleaut32

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic