bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295

Sharing

Copy URL Twitter E-mail

General

Target
bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295
Size 1.5MB
Sample260824-n698fadc49
SHA256 bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295
MD5 1240afbdd8e9961cd505d3bfc65be14a
SHA1 f6266f2866fe85166e28f8b7158a3f1acbbe6545
SHA512 eda31b354292d90fa022e1bb764321ba16a0f2a376674c6f871a650f06e739eb094922c4fdc9384987fdd9184ccfd45efbce238933d674d1bd1f768787affc73
SSDEEP 24576:Qqw0fVmxlPMWzgZXlU4Jj+BEp6pzvI8r+THQ43TJrqUx8MQvoJLfrOxCp:DX3ZXn+BzvI8r+TqUx82JLfrOxCp
TLSH
T110758D21B1B19122E42102F0F86DBB66AC6D6D355B7580CFA3C43A3E9A306D2E737757
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295

File Explorer

bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295

.exe 1.5MB

bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295

IMPHASH 93f6c5a2dd2cb2999d488e124043562f
SHA256 bc15acabe79c0798523d8de7f9e322b6db0057e0d72efdf9bb042932e39b3295
MD5 1240afbdd8e9961cd505d3bfc65be14a
SHA1 f6266f2866fe85166e28f8b7158a3f1acbbe6545
SHA512 eda31b354292d90fa022e1bb764321ba16a0f2a376674c6f871a650f06e739eb094922c4fdc9384987fdd9184ccfd45efbce238933d674d1bd1f768787affc73
SSDEEP 24576:Qqw0fVmxlPMWzgZXlU4Jj+BEp6pzvI8r+THQ43TJrqUx8MQvoJLfrOxCp:DX3ZXn+BzvI8r+TqUx82JLfrOxCp
TLSH
T110758D21B1B19122E42102F0F86DBB66AC6D6D355B7580CFA3C43A3E9A306D2E737757
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

618480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteConsoleW SetEndOfFile FlushFileBuffers GetConsoleOutputCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError SetThreadPriority ReleaseSemaphore CreateEventA GetLocalTime SystemTimeToFileTime DosDateTimeToFileTime DuplicateHandle WriteFile SetFileTime SetFilePointer GetFileType MulDiv QueryPerformanceFrequency QueryPerformanceCounter ReadFile GetFileSize GetACP WideCharToMultiByte MultiByteToWideChar ExitProcess GetModuleHandleW GetTickCount InitializeCriticalSection WritePrivateProfileStringW MapViewOfFile CreateFileW GetTempPathW CreateFileMappingW OpenFileMappingW GetPrivateProfileStringW CopyFileW UnmapViewOfFile GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount TerminateProcess OpenProcess OpenEventW OutputDebugStringA FreeResource GlobalFree GlobalUnlock GlobalLock GlobalAlloc SizeofResource RtlUnwind GetFileAttributesExW CreateMutexW GetVersionExW GetSystemInfo WTSGetActiveConsoleSessionId GetLongPathNameW LockResource LoadResource FindResourceW OutputDebugStringW GetCurrentProcess GetEnvironmentVariableW Process32NextW Process32FirstW CreateToolhelp32Snapshot InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW WaitForSingleObjectEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo CompareStringEx LCMapStringEx CreateSemaphoreA EncodePointer InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW VirtualProtect GetCurrentThreadId SetEvent ResetEvent Sleep CreateEventW FreeLibrary GetProcAddress LoadLibraryW ReleaseMutex CreateMutexA LocalAlloc CloseHandle WaitForSingleObject GetLocaleInfoW GetThreadLocale GetModuleFileNameW GetCurrentDirectoryW LocalFree GetLastError SetFileAttributesW DeleteFileW GetFileAttributesW CreateDirectoryW lstrlenW GetFullPathNameW HeapFree FindClose FindNextFileW GetStdHandle FindFirstFileW

user32

DispatchMessageW TranslateMessage GetMessageW GetWindowThreadProcessId DestroyWindow UpdateLayeredWindow IsWindowVisible CharNextW SetFocus GetFocus GetKeyState SetCapture SetTimer SetRect ShowWindow KillTimer GetSysColor IsWindow CallWindowProcW GetDlgCtrlID EndDialog RemovePropW GetPropW ReleaseCapture GetDC GetWindowDC ReleaseDC GetWindowTextW EndPaint IsIconic InvalidateRect GetCursorPos CreateCaret GetCaretBlinkTime SetCaretPos ScreenToClient MapWindowPoints UnionRect IsRectEmpty PtInRect GetWindowLongW GetWindow SystemParametersInfoW GetDesktopWindow IsZoomed SetWindowRgn MessageBoxW MonitorFromWindow GetMonitorInfoW PeekMessageW DefWindowProcW RegisterClassW RegisterClassExW GetClassInfoExW MsgWaitForMultipleObjects GetSystemMetrics CreateWindowExW FindWindowW GetUpdateRect CharLowerW GetDlgItem SetWindowLongW SetPropW GetParent SendMessageW UnhookWindowsHookEx GetClientRect PostQuitMessage GetWindowRect SetWindowPos SetWindowTextW EnableWindow PostMessageW IntersectRect CallNextHookEx SetForegroundWindow BeginPaint FillRect GetMenu InvalidateRgn CreateAcceleratorTableW ClientToScreen GetCaretPos ShowCaret HideCaret GetWindowRgn MoveWindow GetWindowTextLengthW GetForegroundWindow GetSysColorBrush DrawTextW CharPrevW UpdateWindow LoadIconW OffsetRect InflateRect SetCursor wvsprintfW LoadImageW LoadCursorW AdjustWindowRectEx SetWindowsHookExW

gdi32

GetDIBits GetClipBox GetCharABCWidthsW CreateRectRgnIndirect CombineRgn CreateRoundRectRgn SetWindowOrgEx GetObjectW GetTextColor SelectObject SaveDC RestoreDC GetStockObject DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt GetObjectA GetTextExtentPoint32W SelectClipRgn ExtSelectClipRgn SetBkColor SetBkMode SetDIBits StretchBlt SetStretchBltMode SetTextColor CreateDIBSection TextOutW SetViewportOrgEx CreateRectRgn PtInRegion GetPixel SetPixel GetDeviceCaps SetGraphicsMode GetCurrentObject GetViewportOrgEx GetTextMetricsW ExtTextOutW

comdlg32

GetOpenFileNameW ChooseColorW

advapi32

DuplicateTokenEx InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCreateKeyExW RevertToSelf ImpersonateLoggedOnUser RegSetValueExW RegQueryValueExW RegOpenKeyExW LookupAccountSidW GetTokenInformation OpenProcessToken RegCloseKey

shell32

SHGetFolderPathW Shell_NotifyIconW SHGetSpecialFolderPathA SHGetSpecialFolderPathW ShellExecuteW

ole32

CoInitialize CoTaskMemFree CLSIDFromString CLSIDFromProgID OleLockRunning CoUninitialize CreateStreamOnHGlobal CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

comctl32

_TrackMouseEvent ord17

msimg32

AlphaBlend

shlwapi

PathFileExistsW PathFindExtensionW PathAddBackslashW

winmm

timeKillEvent timeGetDevCaps timeBeginPeriod timeEndPeriod timeGetTime timeSetEvent

gdiplus

GdipSetStringFormatFlags GdipMeasureString GdipDeleteFont GdipDrawImageRectI GdipGetImageHeight GdipGetImageWidth GdiplusStartup GdiplusShutdown GdipDisposeImage GdipCloneImage GdipCreateBitmapFromFile GdipSetStringFormatLineAlign GdipCreateBitmapFromStream GdipImageRotateFlip GdipGetImagePaletteSize GdipDeleteStringFormat GdipSetImagePalette GdipGetImageGraphicsContext GdipDrawImageRect GdipCreateStringFormat GdipCreateFromHDC GdipSetStringFormatTrimming GdipSetSmoothingMode GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipFillRectangle GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipSetTextRenderingHint GdipDrawString GdipCreateImageAttributes GdipDisposeImageAttributes GdipSetImageAttributesColorMatrix GdipCloneBitmapAreaI GdipGetImagePixelFormat GdipSaveImageToFile GdipGetPropertyCount GdipGetPropertyItemSize GdipGetPropertyItem GdipSetPropertyItem GdipSetInterpolationMode GdipDrawImageRectRectI GdipCreateFontFromLogfontA GdipCreateFontFromDC GdipFree GdipAlloc GdipDeleteGraphics GdipSetStringFormatAlign GdipGetImagePalette GdipCreateMatrix GdipDeleteMatrix GdipTranslateMatrix GdipRotateMatrix GdipSetWorldTransform GdipSetPixelOffsetMode GdipSetCompositingQuality GdipCreatePath GdipDeletePath GdipAddPathLineI GdipAddPathArcI GdipCreatePen1 GdipDeletePen GdipSetPenMode GdipSetPenDashStyle GdipDrawLineI GdipDrawRectangleI GdipDrawPath GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipLoadImageFromStream GdipCreateBitmapFromScan0

imm32

ImmSetCompositionWindow ImmReleaseContext ImmAssociateContext ImmGetContext

imagerender

?Instance@CThumbnailImageLoader@@SAAAV1@XZ ?Init@CTempThumbnailAdapter@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Instance@CTempThumbnailAdapter@@SAAAV1@XZ ?RequestThumbnailImage@CThumbnailImageLoader@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ConvertFileSize@CImageUtils@@SAXHAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SelectImageSize@CTempThumbnailAdapter@@QAE_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAI@Z ?SelectImage@CTempThumbnailAdapter@@QAE_NAAUTempImageData@@@Z ?GetEncoderClsid@CImageTransform@@SAHPB_WPAU_GUID@@@Z ?Init@CThumbnailImageLoader@@QAEXPAUHWND__@@@Z

freeimage

_FreeImage_FIFSupportsReading@4

freeimageplus

?getScanWidth@fipImage@@QBEIXZ ?getPalette@fipImage@@QBEPAUtagRGBQUAD@@XZ ?getColorsUsed@fipImage@@QBEIXZ ?identifyFIFU@fipImage@@SA?AW4FREE_IMAGE_FORMAT@@PB_W@Z ??0fipMemoryIO@@QAE@PAEK@Z ??1fipMemoryIO@@UAE@XZ ??0fipWinImage@@QAE@W4FREE_IMAGE_TYPE@@III@Z ??1fipWinImage@@UAE@XZ ?loadFromMemory@fipImage@@QAEHAAVfipMemoryIO@@H@Z ?close@fipMemoryIO@@QAEXXZ ?isValid@fipWinImage@@UBEHXZ ?clear@fipWinImage@@UAEXXZ ?accessPixels@fipImage@@QBEPAEXZ ?getImageType@fipImage@@QBE?AW4FREE_IMAGE_TYPE@@XZ ?copySubImage@fipImage@@QBEHAAV1@HHHH@Z ?getHeight@fipImage@@QBEIXZ ?getWidth@fipImage@@QBEIXZ ?convertTo8Bits@fipImage@@QAEHXZ ?convertTo24Bits@fipImage@@QAEHXZ ?convertTo32Bits@fipImage@@QAEHXZ ?convertToType@fipImage@@QAEHW4FREE_IMAGE_TYPE@@H@Z ?toneMapping@fipImage@@QAEHW4FREE_IMAGE_TMO@@NNNN@Z ?convertToRGBF@fipImage@@QAEHXZ ?getBitsPerPixel@fipImage@@QBEIXZ

d3d9

Direct3DCreate9

wtsapi32

WTSQueryUserToken

generic

count=35, id=259, version=30795,

count=205, id=261, version=30795,

count=39, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=2, id=257, version=30159,

count=19, id=260, version=30034,

count=23, id=259, version=30034,

count=1, id=263, version=30795,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=95, id=261, version=30034,

count=38, id=260, version=30795,

count=39, id=257, version=30795,

count=593, id=1, productName=Unmarked objects,

count=1, id=260, version=30159,

count=75, id=261, version=30159,

count=30, id=265, version=30159,

count=1, id=255, version=30159,

count=1, id=151,

count=1, id=258, version=30159,