9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89

Sharing

Copy URL Twitter E-mail

General

Target
9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89
Size 527KB
Sample260824-ltsfrawakf
SHA256 9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89
MD5 059911624c905cac705429a614fecec7
SHA1 fd790166d2d8f0675fcd423bf264ff313d564057
SHA512 b93f8d659e9367a98c6d0855e94f5157749809dbcc2999b51d2d341b529fd23b0977b742c2b36aebd384e6d3d7dfc746b8bdd87c22fdf2c8cda943fa55572729
SSDEEP 12288:BCgTngz1taM46T2G2rdNuIbrkHITw8GKYiQ+KAV3hA:BlTnWraM4NrXujnAV3hA
TLSH
T146B42822E3E6059AF1B7D3348AB797727936BC404A34E95F6A14C67C2C30F50DE28766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89

File Explorer

9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89

.dll 527KB

9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89

IMPHASH 4fe4db99c18826361ff107aacac6d994
SHA256 9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89
MD5 059911624c905cac705429a614fecec7
SHA1 fd790166d2d8f0675fcd423bf264ff313d564057
SHA512 b93f8d659e9367a98c6d0855e94f5157749809dbcc2999b51d2d341b529fd23b0977b742c2b36aebd384e6d3d7dfc746b8bdd87c22fdf2c8cda943fa55572729
SSDEEP 12288:BCgTngz1taM46T2G2rdNuIbrkHITw8GKYiQ+KAV3hA:BlTnWraM4NrXujnAV3hA
TLSH
T146B42822E3E6059AF1B7D3348AB797727936BC404A34E95F6A14C67C2C30F50DE28766
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CompareFileTime CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateSemaphoreW CreateThread DelayLoadFailureHook DeleteCriticalSection DeleteFileW DosDateTimeToFileTime EnterCriticalSection FileTimeToDosDateTime FileTimeToSystemTime FreeLibrary FreeLibraryAndExitThread GetComputerNameExA GetDateFormatA GetDiskFreeSpaceExA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetLocalTime GetModuleHandleExW GetModuleHandleW GetProcAddress GetShortPathNameW GetSystemTime GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetTimeFormatA GlobalAlloc HeapAlloc HeapReAlloc IdnToAscii IdnToUnicode InitOnceExecuteOnce InitializeCriticalSectionEx IsBadReadPtr IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingW QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResolveDelayLoadedAPI RtlUnwind SetEndOfFile SetEvent SetFilePointer SetFilePointerEx SetThreadDescription Sleep SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile WaitForSingleObject WideCharToMultiByte WriteFile

mpr

WNetCachePassword WNetGetCachedPassword

ntdll

NtQuerySystemTime _vsnprintf

shell32

SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCreateFromUrlW PathMatchSpecW StrStrIA StrToInt64ExW UrlCanonicalizeA UrlCanonicalizeW UrlCombineA UrlCombineW UrlEscapeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _errno _ltow _strdup _stricmp _time64 _wcsdup _wcsicmp _wcsnicmp _wgetenv atoi atol calloc free fwrite getenv iswalnum iswalpha iswspace malloc memchr memcmp memcpy memmove memset qsort rand realloc strchr strcmp strcpy strcspn strlen strncmp strnlen strtok system towlower wcschr wcscmp wcscspn wcslen wcsncmp wcsnlen wcsrchr wcsspn wcsstr wcstol wcstoul

user32

CharLowerW DialogBoxParamW EndDialog GetDlgItem GetWindowLongPtrW GetWindowTextW LoadStringA LoadStringW SendMessageW SetWindowLongPtrW SetWindowTextW wsprintfW

ws2_32

accept bind closesocket connect getsockname getsockopt htons ioctlsocket listen recv select send setsockopt socket WSAGetLastError WSAStartup WSACleanup FreeAddrInfoW GetAddrInfoW freeaddrinfo getaddrinfo getnameinfo inet_ntop

CommitUrlCacheEntryA CommitUrlCacheEntryW CreateMD5SSOHash CreateUrlCacheContainerA CreateUrlCacheContainerW CreateUrlCacheEntryA CreateUrlCacheEntryW CreateUrlCacheGroup DeleteIE3Cache DeleteUrlCacheContainerA DeleteUrlCacheContainerW DeleteUrlCacheEntry DeleteUrlCacheEntryA DeleteUrlCacheEntryW DeleteUrlCacheGroup DeleteWpadCacheForNetworks DetectAutoProxyUrl DllInstall FindCloseUrlCache FindFirstUrlCacheContainerA FindFirstUrlCacheContainerW FindFirstUrlCacheEntryA FindFirstUrlCacheEntryExA FindFirstUrlCacheEntryExW FindFirstUrlCacheEntryW FindFirstUrlCacheGroup FindNextUrlCacheContainerA FindNextUrlCacheContainerW FindNextUrlCacheEntryA FindNextUrlCacheEntryExA FindNextUrlCacheEntryExW FindNextUrlCacheEntryW FindNextUrlCacheGroup ForceNexusLookup ForceNexusLookupExW FreeUrlCacheSpaceA FreeUrlCacheSpaceW FtpCommandA FtpCommandW FtpCreateDirectoryA FtpCreateDirectoryW FtpDeleteFileA FtpDeleteFileW FtpFindFirstFileA FtpFindFirstFileW FtpGetCurrentDirectoryA FtpGetCurrentDirectoryW FtpGetFileA FtpGetFileEx FtpGetFileSize FtpGetFileW FtpOpenFileA FtpOpenFileW FtpPutFileA FtpPutFileEx FtpPutFileW FtpRemoveDirectoryA FtpRemoveDirectoryW FtpRenameFileA FtpRenameFileW FtpSetCurrentDirectoryA FtpSetCurrentDirectoryW GetUrlCacheConfigInfoA GetUrlCacheConfigInfoW GetUrlCacheEntryInfoA GetUrlCacheEntryInfoExA GetUrlCacheEntryInfoExW GetUrlCacheEntryInfoW GetUrlCacheGroupAttributeA GetUrlCacheGroupAttributeW GetUrlCacheHeaderData GopherCreateLocatorA GopherCreateLocatorW GopherFindFirstFileA GopherFindFirstFileW GopherGetAttributeA GopherGetAttributeW GopherGetLocatorTypeA GopherGetLocatorTypeW GopherOpenFileA GopherOpenFileW HttpAddRequestHeadersA HttpAddRequestHeadersW HttpCheckDavCompliance HttpEndRequestA HttpEndRequestW HttpOpenRequestA HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestA HttpSendRequestExA HttpSendRequestExW HttpSendRequestW IncrementUrlCacheHeaderData InternetAlgIdToStringA InternetAlgIdToStringW InternetAttemptConnect InternetAutodial InternetAutodialCallback InternetAutodialHangup InternetCanonicalizeUrlA InternetCanonicalizeUrlW InternetCheckConnectionA InternetCheckConnectionW InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetCombineUrlA InternetCombineUrlW InternetConfirmZoneCrossing InternetConfirmZoneCrossingA InternetConfirmZoneCrossingW InternetConnectA InternetConnectW InternetCrackUrlA InternetCrackUrlW InternetCreateUrlA InternetCreateUrlW InternetDebugGetLocalTime InternetDial InternetDialA InternetDialW InternetEnumPerSiteCookieDecisionA InternetEnumPerSiteCookieDecisionW InternetErrorDlg InternetFindNextFileA InternetFindNextFileW InternetFortezzaCommand InternetGetCertByURL InternetGetCertByURLA InternetGetConnectedState InternetGetConnectedStateEx InternetGetConnectedStateExA InternetGetConnectedStateExW InternetGetCookieA InternetGetCookieExA InternetGetCookieExW InternetGetCookieW InternetGetLastResponseInfoA InternetGetLastResponseInfoW InternetGetPerSiteCookieDecisionA InternetGetPerSiteCookieDecisionW InternetGetSecurityInfoByURL InternetGetSecurityInfoByURLA InternetGetSecurityInfoByURLW InternetGoOnline InternetGoOnlineA InternetGoOnlineW InternetHangUp InternetInitializeAutoProxyDll InternetLockRequestFile InternetOpenA InternetOpenServerPushParse InternetOpenUrlA InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryFortezzaStatus InternetQueryOptionA InternetQueryOptionW InternetReadFile InternetReadFileExA InternetReadFileExW InternetSecurityProtocolToStringA InternetSecurityProtocolToStringW InternetServerPushParse InternetSetCookieA InternetSetCookieExA InternetSetCookieExW InternetSetCookieW InternetSetDialState InternetSetDialStateA InternetSetDialStateW InternetSetFilePointer InternetSetOptionA InternetSetOptionExA InternetSetOptionExW InternetSetOptionW InternetSetPerSiteCookieDecisionA InternetSetPerSiteCookieDecisionW InternetSetStatusCallback InternetSetStatusCallbackA InternetSetStatusCallbackW InternetShowSecurityInfoByURL InternetShowSecurityInfoByURLA InternetShowSecurityInfoByURLW InternetTimeFromSystemTime InternetTimeFromSystemTimeA InternetTimeFromSystemTimeW InternetTimeToSystemTime InternetTimeToSystemTimeA InternetTimeToSystemTimeW InternetUnlockRequestFile InternetWriteFile InternetWriteFileExA InternetWriteFileExW IsHostInProxyBypassList IsUrlCacheEntryExpiredA IsUrlCacheEntryExpiredW LoadUrlCacheContent ParseX509EncodedCertificateForListBoxEntry PrivacyGetZonePreferenceW PrivacySetZonePreferenceW ReadUrlCacheEntryStream RegisterUrlCacheNotification ResumeSuspendedDownload RetrieveUrlCacheEntryFileA RetrieveUrlCacheEntryFileW RetrieveUrlCacheEntryStreamA RetrieveUrlCacheEntryStreamW RunOnceUrlCache SetUrlCacheConfigInfoA SetUrlCacheConfigInfoW SetUrlCacheEntryGroup SetUrlCacheEntryGroupA SetUrlCacheEntryGroupW SetUrlCacheEntryInfoA SetUrlCacheEntryInfoW SetUrlCacheGroupAttributeA SetUrlCacheGroupAttributeW SetUrlCacheHeaderData ShowCertificate ShowClientAuthCerts ShowSecurityInfo ShowX509EncodedCertificate UnlockUrlCacheEntryFile UnlockUrlCacheEntryFileA UnlockUrlCacheEntryFileW UnlockUrlCacheEntryStream UpdateUrlCacheContentPath UrlZonesDetach

Name

.text

Size

272KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

864B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

132KB

Virtual Size

129KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

760B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9e51b1421f89db0652cf91fe62608a51af9a71c532efbdb7a6b681b662a6bb89

advapi32

kernel32

mpr

ntdll

shell32

shlwapi

ucrtbase

user32

ws2_32

generic