e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4

Sharing

Copy URL Twitter E-mail

General

Target
e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4
Size 1.5MB
Sample260824-ntssmaxbkf
SHA256 e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4
MD5 8c40449cae48c3b878285e5e7503cfa7
SHA1 5f01f57e87d06081382268d81cde0eda3541b3bd
SHA512 459296e1e595f69ee17217ec506714c650072fa662313e60b1e2488cc6c7c4e8cdd085f9f2eefb8fae4a52a0e431d9f5f288628dbb7eea650c4f1cfe4f7ea605
SSDEEP 24576:7E8xbnCge15JwhmHuA3QGSVVtZpd3/J15Jvw/zhjf0FcgMYDvbRZO3+uGN:7EZ1vAmHuA3QD3pZ8lHivbRZNH
TLSH
T17465AE12B541C032E4D901B1927D9FF9482DBA321B3488E7A7D42DA999705E37F39B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4

File Explorer

e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4

.dll 1.5MB

e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4

IMPHASH 4d0d8fbb178c8e14a811a48c98abebda
SHA256 e3c6bf2fbbbd4ce3dbabb569990c7d63392340eb4f4130ca514816ded231b8d4
MD5 8c40449cae48c3b878285e5e7503cfa7
SHA1 5f01f57e87d06081382268d81cde0eda3541b3bd
SHA512 459296e1e595f69ee17217ec506714c650072fa662313e60b1e2488cc6c7c4e8cdd085f9f2eefb8fae4a52a0e431d9f5f288628dbb7eea650c4f1cfe4f7ea605
SSDEEP 24576:7E8xbnCge15JwhmHuA3QGSVVtZpd3/J15Jvw/zhjf0FcgMYDvbRZO3+uGN:7EZ1vAmHuA3QD3pZ8lHivbRZNH
TLSH
T17465AE12B541C032E4D901B1927D9FF9482DBA321B3488E7A7D42DA999705E37F39B2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1074868

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntW GetPrivateProfileStringW GetLocalTime WritePrivateProfileStringW GetTickCount DeleteFileW GetTempPathW InitializeCriticalSectionEx RaiseException DecodePointer GetModuleFileNameW LoadLibraryW CreateThread Sleep OpenProcess GetLogicalDriveStringsW QueryDosDeviceW lstrcmpiW LoadLibraryExW CreateMutexW ReleaseMutex MoveFileExW VerifyVersionInfoW VerSetConditionMask GetFileAttributesExW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA WriteConsoleW ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetACP GetModuleFileNameA ExitProcess GetConsoleMode GetConsoleCP SetFilePointerEx GetFileType GetModuleHandleExW FreeLibraryAndExitThread GetCurrentThreadId ExitThread FindFirstFileExW InterlockedFlushSList RtlUnwind GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter TryEnterCriticalSection AreFileApisANSI HeapCreate InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetFileAttributesW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection WaitForSingleObject WaitForMultipleObjects SetEvent HeapDestroy CreateEventW FreeLibrary SystemTimeToFileTime GetFileTime GetFileSize ReadFile GetModuleHandleW GetProcAddress CreateFileW CloseHandle GetTimeZoneInformation CreateDirectoryW CopyFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetLastError WideCharToMultiByte MultiByteToWideChar FindClose FindNextFileW SetLastError GetFullPathNameW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx FindFirstFileW lstrlenW FindResourceExW GetSystemTime FormatMessageA FlushFileBuffers WriteFile FindNextFileA UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSizeEx LocalFree GetCurrentProcessId GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetVersionExW FindResourceW LoadResource HeapValidate GetTempPathA GetDiskFreeSpaceA LockResource SizeofResource GetProcessHeap LoadLibraryExA VirtualFree HeapAlloc HeapFree HeapReAlloc HeapSize GetStringTypeW QueryPerformanceCounter EncodePointer GetCPInfo InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime FormatMessageW CompareStringW LCMapStringW GetLocaleInfoW IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc GetFileAttributesA

user32

DrawFocusRect CharNextW SetCursor UpdateLayeredWindow GetAsyncKeyState EndPaint BeginPaint SetCapture ReleaseCapture GetParent SetTimer KillTimer ReleaseDC GetDC PtInRect ScreenToClient GetCursorPos GetClientRect SendMessageW SetWindowPos ShowWindow IsWindowVisible TranslateMessage DispatchMessageW PostMessageW GetWindowRect OffsetRect EnumDisplayDevicesW wsprintfW GetWindowThreadProcessId CallWindowProcW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DestroyWindow DefWindowProcW RegisterWindowMessageW PostThreadMessageW GetMessageW PeekMessageW UnregisterClassW SetRect GetClassNameW GetWindow GetWindowTextW FindWindowExW GetWindowLongW IsWindow FindWindowW CopyRect UnionRect EqualRect

gdi32

SetViewportOrgEx EnumFontFamiliesW CreateFontW OffsetViewportOrgEx RectVisible GetObjectW CreateDIBSection SaveDC RestoreDC CreateCompatibleBitmap CreateRectRgnIndirect BitBlt SelectClipRgn CreateCompatibleDC CreateFontIndirectW ExtTextOutW GetTextExtentPoint32W DeleteObject SelectObject GetDeviceCaps DeleteDC GetPixel CreateDCW SetBkColor

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegGetValueW RegQueryValueExW RegCloseKey RegDeleteKeyW RegQueryInfoKeyW RegEnumKeyExW

shell32

SHGetSpecialFolderPathW SHGetPathFromIDListW SHCreateDirectoryExW ShellExecuteW SHGetSpecialFolderLocation

ole32

CoInitializeEx CoCreateInstance CoInitialize CoUninitialize CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

VarDateFromStr VariantTimeToSystemTime SystemTimeToVariantTime VarUI4FromStr

shlwapi

StrStrIW PathFindFileNameW PathIsDirectoryW PathIsRelativeW PathIsRootW StrStrIA StrCmpIW PathFindExtensionW PathCombineW PathRemoveFileSpecW PathFileExistsW PathAppendW SHGetValueW

comctl32

_TrackMouseEvent

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetCrackUrlW

psapi

GetProcessImageFileNameW

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipSetStringFormatTrimming GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipDeleteBrush GdipCreateSolidFill GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipFillRectangleI GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags

generic

count=16, id=241, version=40116,

count=159, id=243, version=40116,

count=31, id=242, version=40116,

count=1, id=199, version=41118,

count=25, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=260, version=27051,

count=17, id=261, version=27051,

count=14, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=64, id=261, version=26706,

count=34, id=260, version=26706,

count=3, id=206, version=65501,

count=1, id=208, version=65501,

count=29, id=203, version=65501,

count=351, id=1, productName=Unmarked objects,

count=23, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,