6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb

Sharing

Copy URL Twitter E-mail

General

Target
6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb
Size 993KB
Sample260823-sjyncaxgkf
SHA256 6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb
MD5 c3cfb3455c60b5c3a0131178bb2f62ac
SHA1 8da8da4d9a17aae321cdc18f833cf9d1ce70692f
SHA512 dca71442293ce23087f591005ce54f4f1bee873f372f0b7d914e2953bc11d834fa44c0e62697f43d162b95511960fec8d485eda9f2630c408411d71092820d3b
SSDEEP 24576:eKNEcwRnTqTzO5dWHs5TuSYgFtC4FTfgIOUsELF:eiEc0TqCdWHQRYgTC4Jg+R
TLSH
T1FA25F00177F18632F5F32A3059B497A2997E78305F38D5DF438049AA9970AE0DA31B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb

File Explorer

6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb

.exe 993KB

6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb

IMPHASH 6a7802c91fee51c72ff47491af4ab465
SHA256 6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb
MD5 c3cfb3455c60b5c3a0131178bb2f62ac
SHA1 8da8da4d9a17aae321cdc18f833cf9d1ce70692f
SHA512 dca71442293ce23087f591005ce54f4f1bee873f372f0b7d914e2953bc11d834fa44c0e62697f43d162b95511960fec8d485eda9f2630c408411d71092820d3b
SSDEEP 24576:eKNEcwRnTqTzO5dWHs5TuSYgFtC4FTfgIOUsELF:eiEc0TqCdWHQRYgTC4Jg+R
TLSH
T1FA25F00177F18632F5F32A3059B497A2997E78305F38D5DF438049AA9970AE0DA31B7B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryW GetProcAddress ExpandEnvironmentStringsW GetFileAttributesW OpenProcess TerminateProcess WaitForSingleObject Sleep GetWindowsDirectoryW CreateProcessW RemoveDirectoryW DeleteFileW GetLogicalDrives GetDriveTypeW lstrcmpiW GetStdHandle WriteConsoleW lstrlenW WideCharToMultiByte LocalAlloc LocalFree AttachConsole AllocConsole GetCommandLineW GetCommandLineA GetUserDefaultUILanguage SetHandleInformation lstrcpynW CreatePipe CreateFileW GetSystemDirectoryW MultiByteToWideChar SetFilePointerEx GetSystemWindowsDirectoryW IsWow64Process GetExitCodeProcess LoadLibraryA VirtualProtect VirtualAlloc VirtualFree HeapAlloc GetProcessHeap HeapFree lstrcatA GetFileSize GetModuleFileNameW FreeLibrary UnlockFile FlushFileBuffers HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP GetModuleHandleW GlobalLock GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RaiseException RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindClose FindNextFileW CopyFileW SetFileAttributesW FindFirstFileW CreateDirectoryW GetFullPathNameW GlobalUnlock GetFileSizeEx GlobalFree GlobalAlloc LockResource LoadResource SizeofResource FindResourceA GetModuleHandleA GetCurrentProcess lstrcpynA ReadFile WriteFile DeleteFileA GetTickCount GetSystemTimeAsFileTime GetModuleFileNameA CloseHandle DeviceIoControl GetLastError CreateFileA DecodePointer

user32

SetCursor ExitWindowsEx MessageBoxW SetWindowTextW GetDlgItem SendMessageA GetWindowLongA SetWindowLongA CreateWindowExW SendMessageW SetPropA SetFocus SendDlgItemMessageA GetPropA DestroyWindow RemovePropA DefWindowProcA LoadCursorA RegisterClassA AdjustWindowRect GetSystemMetrics CreateWindowExA ShowWindow UpdateWindow IsWindow GetMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetDlgItemTextA GetWindowRect GetDesktopWindow SetWindowPos EnableWindow SetForegroundWindow SetTimer InvalidateRect SetRect PtInRect GetClientRect CheckRadioButton IsDlgButtonChecked SendNotifyMessageW FindWindowW GetWindowThreadProcessId PostMessageA CreatePopupMenu AppendMenuW ClientToScreen TrackPopupMenu DestroyMenu BeginPaint EndPaint TrackMouseEvent GetCursorPos ScreenToClient PostQuitMessage wsprintfA KillTimer LoadIconA

gdi32

DeleteDC BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC CreateFontW DeleteObject GetStockObject

advapi32

RegQueryValueExA CheckTokenMembership RegFlushKey RegDeleteValueW CreateProcessAsUserW DuplicateTokenEx RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegSetValueExA RegCreateKeyExA RegCloseKey RegOpenKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken FreeSid AllocateAndInitializeSid

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExA SHChangeNotify

ole32

CreateStreamOnHGlobal CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdiplus

GdipAlloc GdipFree GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipGetImageHeight GdipGetImageWidth GdipCloneImage GdipLoadImageFromStream GdipGetFontHeight GdipDeleteFont GdipCreateFont GdipIsStyleAvailable GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipDrawImageRect GdipMeasureString GdipDrawString GdipFillPath GdipFillEllipse GdipFillRectangle GdipGraphicsClear GdipDrawPath GdipDrawArc GdipDrawLine GdipSetPixelOffsetMode GdipSetSmoothingMode GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetCompositingQuality GdipDeleteGraphics GdipCreateFromHDC GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreatePath GdipStringFormatGetGenericTypographic GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipGetStringFormatFlags GdipSetStringFormatFlags GdipDeleteStringFormat GdipCloneStringFormat GdipDeletePen GdipCreatePen1 GdipDisposeImage GdipCreateSolidFill GdipCloneBrush

dwmapi

DwmSetWindowAttribute

comctl32

InitCommonControlsEx

bcrypt

BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptSetProperty BCryptHashData BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCreateHash BCryptGenerateSymmetricKey

Name

.text

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

722KB

Virtual Size

721KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6012d8381666f914266213659899e922aeff148dcd62942ed8cbcccd109a13bb

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

dwmapi

comctl32

bcrypt

generic