d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa

Sharing

Copy URL Twitter E-mail

General

Target
d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa
Size 227KB
Sample260825-br2xasff36
SHA256 d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa
MD5 6308bb4c1e31a461f07c754fee7d0c51
SHA1 ced9c5a57d65fe42f893eb3282c54c5b868a7bbe
SHA512 ccfa2f4ae1f0cba5a92042548136a4ef226df9aa93cd0a677cdaf75577bbccd44161a0d5cda3185f8abbf81cfd4cb6cf12d9ebd8dace7d0c5505068ec9caeecf
SSDEEP 6144:V8uM9mnewyqqBsT5kZXpMDR4wbPWwINq+9kbup:frqOvDRXq
TLSH
T1E5343B207DF6C160D8A202BC14F5AFB59C78FC34172489DB2786BFAE99B05C15934B7A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa

File Explorer

d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa

.exe 227KB

d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa

IMPHASH 38409fc1e8ea9c9ea2a7af603b351744
SHA256 d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa
MD5 6308bb4c1e31a461f07c754fee7d0c51
SHA1 ced9c5a57d65fe42f893eb3282c54c5b868a7bbe
SHA512 ccfa2f4ae1f0cba5a92042548136a4ef226df9aa93cd0a677cdaf75577bbccd44161a0d5cda3185f8abbf81cfd4cb6cf12d9ebd8dace7d0c5505068ec9caeecf
SSDEEP 6144:V8uM9mnewyqqBsT5kZXpMDR4wbPWwINq+9kbup:frqOvDRXq
TLSH
T1E5343B207DF6C160D8A202BC14F5AFB59C78FC34172489DB2786BFAE99B05C15934B7A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\notepad4\notepad4\build\bin\Release\Win32\matepath.pdb

comctl32

ord380 InitCommonControlsEx ImageList_Destroy ImageList_Create ImageList_AddMasked ord413 PropertySheetW ord412 ord410 CreateStatusWindowW

shlwapi

StrTrimW PathUnquoteSpacesW SHAutoComplete StrStrIW PathFindFileNameW PathIsRelativeW PathAppendW StrCatBuffW PathIsDirectoryW StrRChrW StrFormatByteSizeW PathCompactPathExW StrStrW PathCommonPrefixW PathFindExtensionW PathCanonicalizeW PathIsRootW PathUnExpandEnvStringsW PathIsPrefixW PathRelativePathToW PathRemoveFileSpecW PathCombineW PathRemoveBackslashW PathIsSameRootW StrRetToBufW PathAddBackslashW PathMatchSpecW StrChrW PathQuoteSpacesW

uxtheme

IsAppThemed SetWindowTheme

kernel32

GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP GetCurrentThreadId WritePrivateProfileStringW HeapFree lstrcpynW ExpandEnvironmentStringsW GetShortPathNameW GetModuleFileNameW GetPrivateProfileSectionW GetFileAttributesW GetVersionExW GetSystemDirectoryW SetFileAttributesW GetPrivateProfileStringW lstrcatW GetNativeSystemInfo HeapAlloc GetCurrentDirectoryW lstrcpyW WritePrivateProfileSectionW CompareStringOrdinal WaitForSingleObject CreateThread SizeofResource SearchPathW GetFullPathNameW GetCurrentProcess lstrlenW GetFinalPathNameByHandleW GetLocaleInfoEx CreateFileW GetPrivateProfileSectionNamesW FreeResource OpenProcess CreateEventW SetEvent LockResource GlobalAlloc CloseHandle LoadResource FindResourceW GetWindowsDirectoryW GetProcAddress GlobalLock GetModuleHandleW QueryFullProcessImageNameW GlobalUnlock MulDiv CreateDirectoryW GetFileSizeEx GetCommandLineW WriteFile GetTimeFormatEx SetErrorMode GetDateFormatEx FindFirstChangeNotificationW GetFileAttributesExW GlobalSize FileTimeToSystemTime FindCloseChangeNotification GlobalFree FileTimeToLocalFileTime FindNextChangeNotification SetCurrentDirectoryW GetProcessHeap FreeLibrary CopyFileW LoadLibraryExW IsValidCodePage FindNextFileW FindFirstFileExW FindClose UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleExW TerminateProcess ExitProcess GetStdHandle RaiseException DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetLastError RtlUnwind IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualProtect LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx WriteConsoleW ResetEvent DecodePointer

user32

GetMessageTime EnumWindows SetMenuDefaultItem SetWindowPlacement SetMenuItemInfoW SetTimer OffsetRect GetSubMenu TrackPopupMenu LoadAcceleratorsW GetWindowPlacement RegisterClassExW UnregisterClassW GetSystemMetrics DeleteMenu ShowOwnedPopups MonitorFromWindow EqualRect IsWindowVisible GetFocus MonitorFromPoint ShowWindowAsync LoadMenuW GetKeyState AdjustWindowRectEx GetSystemMenu DefWindowProcW GetMenuItemInfoW GetMessageW SetFocus GetWindowLongW GetWindowTextLengthW PostMessageW CheckMenuRadioItem GetWindowRect DestroyWindow SetWindowPos CheckRadioButton MessageBoxExW CreateWindowExW BringWindowToTop SetWindowTextW MessageBeep CreatePopupMenu WindowFromPoint DestroyCursor LoadStringW GetActiveWindow ShowWindow TranslateAcceleratorW CheckMenuItem IsZoomed KillTimer PostQuitMessage EnableMenuItem RegisterWindowMessageW UpdateWindow IsIconic GetWindowThreadProcessId DrawAnimatedRects DeferWindowPos GetWindow FindWindowExW GetDC CopyImage MonitorFromRect SetActiveWindow BeginDeferWindowPos OpenClipboard DispatchMessageW RedrawWindow DdeCreateStringHandleW DdeConnect GetMonitorInfoW CloseClipboard EmptyClipboard PeekMessageW wvsprintfW DestroyIcon SetDlgItemTextW GetDlgItemTextW SendDlgItemMessageW GetSysColor IsWindowEnabled IsDlgButtonChecked DestroyMenu GetMenuStringW LoadIconW LoadCursorW GetClassNameW SetCapture SetCursor wsprintfW SetWindowLongW TrackPopupMenuEx GetComboBoxInfo GetDlgItem AppendMenuW CheckDlgButton ReleaseCapture InvalidateRect ChildWindowFromPoint GetCursorPos EnableWindow GetWindowTextW SendMessageW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetParent MapWindowPoints DdeInitializeW DdeUninitialize DialogBoxIndirectParamW IntersectRect DdeClientTransaction SetPropW TranslateMessage EndDeferWindowPos SetClipboardData MapDialogRect GetClientRect SetRect DdeDisconnect SystemParametersInfoW DdeFreeStringHandle SetForegroundWindow LoadImageW SetCursorPos ReleaseDC GetPropW EndDialog RemovePropW SetLayeredWindowAttributes

gdi32

GetObjectW DeleteObject CreateSolidBrush SelectObject GetDeviceCaps GetTextExtentPoint32W CreateFontIndirectW

comdlg32

ChooseColorW

advapi32

RegOpenKeyExW RegDeleteTreeW RegCreateKeyExW RegCloseKey GetTokenInformation OpenProcessToken RegSetValueExW RegGetValueW

shell32

SHFileOperationW SHGetKnownFolderIDList ShellExecuteExW SHGetPathFromIDListW SHGetDataFromIDListW SHGetDesktopFolder ord180 SHCreateItemFromParsingName SHAppBarMessage SHOpenFolderAndSelectItems SHGetKnownFolderPath ord190 DragQueryFileW Shell_NotifyIconW SHCreateDirectoryExW DragAcceptFiles DragFinish SHGetFileInfoW ShellExecuteW

ole32

CoCreateInstance DoDragDrop CoTaskMemAlloc CoTaskMemFree OleUninitialize OleInitialize

Name

.text

Size

119KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d1d63a48a548c5805a0d329c2997b3b581322db32dc2de311578b1269dc369fa

comctl32

shlwapi

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic