961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f

Sharing

Copy URL Twitter E-mail

General

Target
961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f
Size 367KB
Sample260825-3fb1aazfrc
SHA256 961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f
MD5 d7a303e07addd88f34b0318df6289c95
SHA1 f331429e334bbc09ca1a0c2d4def837c82ee6448
SHA512 44905431c4aa973105cfc9bb9e0922a041b2a0745c27791d2a794c86d67240ec5b1dfa326b011447827fa9f3248e6e951a5f52323faa1401212a99e9a2f455b7
SSDEEP 3072:2OJvSeQP+/bblbFvS9K5ENWKZSazLKcfPVRpfENrmbvJnckTESOoESOaUUkl:MPP+/bTP50WKZhacftEwbvJ/TEsEV
TLSH
T1EC84F8393D42C893C1DAB03188517BF27257ECA16AA3CE5F278873899F99260CF65D47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f

File Explorer

961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f

.exe 367KB

961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f

IMPHASH c56b6df672f7aed543494644f61f2e85
SHA256 961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f
MD5 d7a303e07addd88f34b0318df6289c95
SHA1 f331429e334bbc09ca1a0c2d4def837c82ee6448
SHA512 44905431c4aa973105cfc9bb9e0922a041b2a0745c27791d2a794c86d67240ec5b1dfa326b011447827fa9f3248e6e951a5f52323faa1401212a99e9a2f455b7
SSDEEP 3072:2OJvSeQP+/bblbFvS9K5ENWKZSazLKcfPVRpfENrmbvJnckTESOoESOaUUkl:MPP+/bTP50WKZhacftEwbvJ/TEsEV
TLSH
T1EC84F8393D42C893C1DAB03188517BF27257ECA16AA3CE5F278873899F99260CF65D47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

84945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\build\deskcal4\output\bin32\pdb\dkreport.pdb

iphlpapi

GetAdaptersInfo

kernel32

GetPrivateProfileIntW DeleteFileW GetCurrentThreadId DecodePointer LeaveCriticalSection EnterCriticalSection LoadLibraryW Sleep LockResource FindResourceExW OutputDebugStringW UnmapViewOfFile CreateFileMappingW MapViewOfFile SetLastError VirtualQueryEx GetThreadSelectorEntry OpenProcess OpenThread CreateFileW Thread32First Thread32Next Module32FirstW Module32NextW ReadProcessMemory MoveFileExW WideCharToMultiByte GetVolumeInformationW GlobalAlloc GlobalFree VerifyVersionInfoW VerSetConditionMask CompareStringW lstrlenW GetTickCount GetVersionExW GetVersion MulDiv GetCommandLineW GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer IsDebuggerPresent GetSystemTimeAsFileTime GetProcessHeap GetModuleFileNameW CloseHandle FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW DeleteCriticalSection RaiseException InitializeCriticalSectionAndSpinCount CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc

user32

FillRect GetWindowLongW SetRectEmpty GetClassNameW LoadCursorW SystemParametersInfoW CreateWindowExW EnableWindow GetWindowTextW EndPaint BeginPaint GetSystemMetrics LoadImageW GetDC ReleaseDC DrawTextW IsWindow IsWindowEnabled ShowWindow MoveWindow ScreenToClient OffsetRect MessageBoxW CallWindowProcW GetFocus DrawFocusRect ReleaseCapture CharNextW DefWindowProcW GetActiveWindow DestroyWindow UnregisterClassW DialogBoxParamW GetDlgCtrlID GetCursorPos PtInRect UpdateWindow SetCursor TrackMouseEvent SetFocus GetCapture SetCapture SendMessageW GetWindowTextLengthW InvalidateRect RedrawWindow SetWindowLongW GetSysColor GetKeyState EnumChildWindows IsWindowVisible SetWindowTextW GetDlgItem SetWindowPos EndDialog MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindow

gdi32

CreateFontW DeleteDC ExtTextOutW CreateFontIndirectW GetObjectW SelectObject DeleteObject SetBkColor GetStockObject SetBkMode SetTextColor

advapi32

RegDeleteKeyW RegEnumKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryInfoKeyW

shell32

ShellExecuteW

ole32

OleInitialize CoTaskMemFree CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoInitialize

oleaut32

SysFreeString SysAllocString VarUI4FromStr

shlwapi

PathFileExistsW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW

comctl32

InitCommonControlsEx

msvcp140

?_Xlength_error@std@@YAXPBD@Z

dkcore

?GetService@Service@Util@@YAJABU_GUID@@PAPAX@Z ?CreateInstanceFromClassFactory@@YAJABU_GUID@@PAPAXPAUIUnknown@@@Z

psapi

GetModuleFileNameExW

dbghelp

MiniDumpWriteDump SymCleanup SymUnloadModule64 SymGetLineFromAddr SymFromAddr SymLoadModule64 SymInitialize SymGetModuleBase SymSetOptions

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

wininet

HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetSetOptionA InternetWriteFile InternetCloseHandle HttpSendRequestW HttpOpenRequestW InternetConnectW InternetOpenW HttpSendRequestExA InternetReadFile InternetOpenA HttpEndRequestA

vcruntime140

_CxxThrowException __current_exception_context __current_exception _except_handler4_common wcschr __std_exception_destroy __std_exception_copy memmove wcsstr memcpy __std_terminate wcsrchr memset __CxxFrameHandler3

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsnicmp wcsnlen iswdigit wcsncpy_s wcsspn wcscspn wcscpy_s strlen strcat_s _strlwr_s _wcsicmp strncpy_s wcslen wcscmp strcpy_s _wcslwr_s wmemcpy_s

api-ms-win-crt-heap-l1-1-0

calloc free malloc _callnewh _recalloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_exit exit _initterm_e _register_thread_local_exe_atexit_callback _c_exit _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _controlfp_s _set_app_type _seh_filter_exe terminate _invoke_watson _cexit _crt_atexit _errno _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo _initterm strerror

api-ms-win-crt-filesystem-l1-1-0

_waccess _wstat32 _wstat64i32 _waccess_s

api-ms-win-crt-locale-l1-1-0

setlocale _configthreadlocale

api-ms-win-crt-stdio-l1-1-0

_lseeki64 __stdio_common_vswprintf __stdio_common_vsprintf feof __stdio_common_vswprintf_s fread _wopen __stdio_common_vsnwprintf_s fwrite _write __stdio_common_vsprintf_s _close _open _wfopen_s __p__commode fgetws fclose __stdio_common_vfwprintf_s _set_fmode fputws

api-ms-win-crt-convert-l1-1-0

wcstombs _wtoi wcstol

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

961a32c262b5aa06f464bfc40cfe6d054c3318f6b95f74a378247de2ffabc14f

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msvcp140

dkcore

psapi

dbghelp

version

wininet

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

generic