be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024

Sharing

Copy URL Twitter E-mail

General

Target
be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024
Size 1.5MB
Sample260825-e2wptasxew
SHA256 be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024
MD5 c914d102409ba18862754662c8f784ee
SHA1 643551cef392a64d143b0efb6e252feddf51939d
SHA512 0c0341f11bce8e5708e784cb8465b834099f9b38ed877edf320b011d2eeb7595f620fe0c40283538aa20973b76e11b9fcda390e9e2ed44a2c3f965a61a60487d
SSDEEP 24576:qSlmxIbfwQm3qQqlS9u8zJrfrRRpJoU7v+wITKBjXSGtp1bvwjPvuYd0lHEbW+uR:9fYqYzRtR3oU7gT61YTyHEbxgL5aq
TLSH
T16E75AE127641C036E8D901F1567DAFFA593DAB31072948DBABD81DA859300E37B39F2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024

File Explorer

be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024

.dll 1.5MB

be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024

IMPHASH 44c5d27dcda08984fa2d8e4ce4250fca
SHA256 be136c89c4d0b99ddfc7a49ec0d047e7e05fd356e5b8045c6bb1ae45b6320024
MD5 c914d102409ba18862754662c8f784ee
SHA1 643551cef392a64d143b0efb6e252feddf51939d
SHA512 0c0341f11bce8e5708e784cb8465b834099f9b38ed877edf320b011d2eeb7595f620fe0c40283538aa20973b76e11b9fcda390e9e2ed44a2c3f965a61a60487d
SSDEEP 24576:qSlmxIbfwQm3qQqlS9u8zJrfrRRpJoU7v+wITKBjXSGtp1bvwjPvuYd0lHEbW+uR:9fYqYzRtR3oU7gT61YTyHEbxgL5aq
TLSH
T16E75AE127641C036E8D901F1567DAFFA593DAB31072948DBABD81DA859300E37B39F2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1125764

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\code\clean_master\fresh_home\realization_module\br_patch\bin\br_patch.pdb

kernel32

CreateDirectoryW GetPrivateProfileIntW GetLocalTime WritePrivateProfileStringW GetTickCount DeleteFileW GetTempPathW CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryW InitializeCriticalSectionEx RaiseException DecodePointer GetModuleFileNameW CreateThread Sleep OpenProcess GetLogicalDriveStringsW QueryDosDeviceW lstrcmpiW LoadLibraryExW CreateMutexW ReleaseMutex MoveFileExW VerifyVersionInfoW VerSetConditionMask MultiByteToWideChar GetCurrentThreadId EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection SetEnvironmentVariableA FreeEnvironmentStringsW WaitForSingleObject GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA WriteConsoleW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetStdHandle GetACP GetModuleFileNameA ExitProcess GetConsoleMode FindClose SetFilePointerEx GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread FindFirstFileExW InterlockedFlushSList RtlUnwind GetStartupInfoW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter TryEnterCriticalSection AreFileApisANSI HeapCreate InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile WaitForMultipleObjects SetEvent CreateEventW FreeLibrary SystemTimeToFileTime GetFileTime GetFileSize ReadFile GetModuleHandleW GetProcAddress CreateFileW CloseHandle GetPrivateProfileStringW GetTimeZoneInformation CopyFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetLastError GetEnvironmentStringsW WideCharToMultiByte FindNextFileW SetLastError GetFullPathNameW FindFirstFileW lstrlenW FindResourceExW FindResourceW LoadResource LockResource SizeofResource SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetFileAttributesW GetVersionExW HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingA LockFileEx GetSystemTime FormatMessageA FlushFileBuffers WriteFile FindNextFileA UnmapViewOfFile MapViewOfFile CreateFileMappingW GetFileSizeEx LocalFree GetProcessHeap HeapDestroy GetCurrentProcessId GlobalFree GlobalUnlock GlobalLock GlobalAlloc LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache HeapAlloc HeapFree HeapReAlloc HeapSize GetConsoleCP GetStringTypeW FormatMessageW QueryPerformanceCounter EncodePointer GetCPInfo InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess

user32

DrawFocusRect SetCursor EqualRect UnionRect IsWindow FindWindowW GetWindowLongW FindWindowExW wsprintfW GetWindowTextW CopyRect UpdateLayeredWindow GetAsyncKeyState EndPaint BeginPaint SetCapture ReleaseCapture GetParent SetTimer KillTimer ReleaseDC GetDC PtInRect ScreenToClient GetCursorPos GetClientRect SendMessageW SetWindowPos ShowWindow IsWindowVisible TranslateMessage DispatchMessageW PostMessageW GetWindowRect OffsetRect EnumDisplayDevicesW CharNextW GetWindowThreadProcessId CallWindowProcW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW DestroyWindow DefWindowProcW RegisterWindowMessageW PostThreadMessageW GetMessageW PeekMessageW UnregisterClassW SetRect GetClassNameW GetWindow

gdi32

GetObjectW CreateDIBSection SaveDC RestoreDC CreateCompatibleBitmap CreateRectRgnIndirect BitBlt SelectClipRgn CreateCompatibleDC CreateFontIndirectW ExtTextOutW SetBkColor GetTextExtentPoint32W DeleteObject SelectObject GetDeviceCaps DeleteDC GetPixel CreateDCW RectVisible CreateFontW EnumFontFamiliesW SetViewportOrgEx OffsetViewportOrgEx

advapi32

RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryValueExW RegCloseKey RegDeleteKeyW RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegGetValueW

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHCreateDirectoryExW ShellExecuteW SHGetSpecialFolderPathW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoInitialize CoCreateInstance CoInitializeEx CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime VarUI4FromStr VarDateFromStr

shlwapi

PathIsDirectoryW PathCombineW PathRemoveFileSpecW SHGetValueW PathFileExistsW PathFindFileNameW StrCmpIW StrStrIA StrStrIW PathIsRootW PathIsRelativeW PathFindExtensionW PathAppendW

comctl32

_TrackMouseEvent

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetCrackUrlW

ws2_32

ntohs

psapi

GetProcessImageFileNameW

gdiplus

GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCloneImage GdipSetStringFormatAlign GdipDisposeImage GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdiplusStartup GdiplusShutdown GdipAlloc GdipFree GdipDeleteBrush GdipCreateSolidFill GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipSetTextRenderingHint GdipFillRectangleI GdipDrawImageRectRect GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDrawString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags

generic

count=16, id=241, version=40116,

count=169, id=243, version=40116,

count=31, id=242, version=40116,

count=1, id=199, version=41118,

count=25, id=259, version=26706,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=1, id=260, version=27051,

count=17, id=261, version=27051,

count=14, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=65, id=261, version=26706,

count=34, id=260, version=26706,

count=3, id=206, version=65501,

count=1, id=208, version=65501,

count=31, id=203, version=65501,

count=355, id=1, productName=Unmarked objects,

count=27, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,