7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8

Sharing

Copy URL Twitter E-mail

General

Target
7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8
Size 1.4MB
Sample260823-jsd6mavbnd
SHA256 7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8
MD5 3e4bd82fb12e7f0a42c60d95fae46fc8
SHA1 456efd8fcfea8a6f5128da732ee8caeda1003268
SHA512 d8279891b25b5bfd653b17f1c90a9527b67dc7e06a85b33767d6d619e980abf2a1e9a5bc746fc25f4e2e61ca51ba81192b8aa0aab5e5aed66d282171cdc72b0f
SSDEEP 24576:o1Hpbl63RqxE6D0zvceW79zEBMhB/kYvwpZfmmxXWjV3SOPcUeo7ABtmbnCtNTSh:o1Hy3RqxE6AA79zE2CYvwpZeVV3B0/tM
TLSH
T1DB65D01139C18333D673E47209A5FA74996DB8310E319A8F67841B3EAF709D15E26A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8

File Explorer

7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8

.exe 1.4MB

7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8

IMPHASH cf9549576bd09c2866bf07120782839b
SHA256 7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8
MD5 3e4bd82fb12e7f0a42c60d95fae46fc8
SHA1 456efd8fcfea8a6f5128da732ee8caeda1003268
SHA512 d8279891b25b5bfd653b17f1c90a9527b67dc7e06a85b33767d6d619e980abf2a1e9a5bc746fc25f4e2e61ca51ba81192b8aa0aab5e5aed66d282171cdc72b0f
SSDEEP 24576:o1Hpbl63RqxE6D0zvceW79zEBMhB/kYvwpZfmmxXWjV3SOPcUeo7ABtmbnCtNTSh:o1Hy3RqxE6AA79zE2CYvwpZeVV3B0/tM
TLSH
T1DB65D01139C18333D673E47209A5FA74996DB8310E319A8F67841B3EAF709D15E26A3F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

279958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\thunder_thirdparty\XLBugReport_VS2019\XLBugReport\bin\Release\XLBugReport.pdb

dbghelp

MiniDumpReadDumpStream

ws2_32

connect htons inet_addr recv send closesocket getsockname setsockopt socket gethostbyname WSAStartup WSACleanup WSAAsyncGetHostByName getpeername WSACancelAsyncRequest ntohs WSAAsyncSelect WSAGetLastError

minizip

zipWriteInFileInZip zipCloseFileInZip zipClose zipOpenNewFileInZip zipOpen

libeay32

ord197 ord196 ord1804 ord464

libcurl

curl_slist_append curl_global_cleanup curl_global_init curl_easy_getinfo curl_easy_cleanup curl_easy_perform curl_easy_setopt curl_easy_init

kernel32

FreeLibraryAndExitThread ResumeThread ExitThread FileTimeToSystemTime PeekNamedPipe CreateFileW CloseHandle RaiseException CreateFileMappingW MapViewOfFile MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetTempPathW GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection WaitForSingleObject GetExitCodeProcess GetSystemTime FindResourceExW LoadResource LockResource SizeofResource FindResourceW CopyFileW SystemTimeToTzSpecificLocalTime DecodePointer InitializeCriticalSection CreateThread GetCurrentThreadId TerminateThread GetModuleFileNameA OutputDebugStringW SetLastError SetErrorMode FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW ExitProcess GlobalUnlock GlobalLock lstrcmpiW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW FileTimeToLocalFileTime ReadFile FileTimeToDosDateTime InitializeCriticalSectionEx IsBadCodePtr SetFileTime WriteFile MoveFileW SystemTimeToFileTime GetFileAttributesExW GetFileSizeEx FormatMessageW GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetTickCount GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread CreateEventW LocalFree FormatMessageA LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead WaitForSingleObjectEx EncodePointer IsDebuggerPresent GetStdHandle GetCurrentThread UnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId RtlUnwind InterlockedFlushSList GetDriveTypeW GetFileInformationByHandle SetUnhandledExceptionFilter TerminateProcess SetEvent ResetEvent GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetConsoleMode ReadConsoleW SetCurrentDirectoryW GetCurrentDirectoryW GetModuleHandleExW GetFullPathNameW SetStdHandle GetConsoleCP SetFilePointerEx SetConsoleCtrlHandler FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW GetFileType FreeEnvironmentStringsW SetEnvironmentVariableW FlushFileBuffers SetEndOfFile GlobalAlloc WriteConsoleW

user32

MessageBeep MessageBoxW GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetCursor GetCursorPos MapWindowPoints GetSysColor InflateRect SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC DrawTextW LoadCursorW LoadImageW SystemParametersInfoW GetDesktopWindow MonitorFromWindow GetWindowLongW SetWindowLongW GetParent GetWindow ShowCursor GetSystemMetrics IsWindowEnabled KillTimer SetTimer GetActiveWindow EmptyClipboard SetClipboardData CloseClipboard OpenClipboard SetDlgItemTextW GetDlgItem EndDialog DialogBoxParamW SetWindowPos ShowWindow DestroyWindow IsWindow CallWindowProcW DefWindowProcW SendMessageW PostThreadMessageW PeekMessageW UnregisterClassW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW wsprintfW GetMonitorInfoW PostMessageW RegisterClassExW GetClassInfoExW CreateWindowExW LoadBitmapW CharNextW

gdi32

OffsetWindowOrgEx SetWindowOrgEx ExtTextOutW GetObjectW SetTextColor SetBkMode SetBkColor SelectObject ExtSelectClipRgn Rectangle GetWindowOrgEx GetStockObject BitBlt CreateCompatibleDC CreateFontIndirectW CreateRectRgnIndirect DeleteObject DeleteDC

advapi32

TraceEvent RegCreateKeyExW RegDeleteKeyW RegDeleteValueW GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegCloseKey

shell32

ShellExecuteW SHCreateDirectoryExW ord165 ShellExecuteExW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoInitialize CoCreateInstance CoUninitialize

oleaut32

VarUI4FromStr SysFreeString SysAllocStringLen SysAllocString VariantClear

shlwapi

PathFileExistsW PathCombineA PathAppendW

comctl32

_TrackMouseEvent InitCommonControlsEx

Sharing

General

Malware Config

Signatures

File Explorer

7f790d6b2b032f1ed79016bb664edd6ab11c8e69ad3d06b740c315eeef9a86e8

dbghelp

ws2_32

minizip

libeay32

libcurl

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic