820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69

Sharing

Copy URL Twitter E-mail

General

Target
820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69
Size 1.7MB
Sample260825-lmsg6sgf28
SHA256 820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69
MD5 d0f7d9956bd2bd8bf2be5a746ba5e7b6
SHA1 01fc0e3d2a456b93945064b75ad939447c93e470
SHA512 54f6dfa50ec3c94de98c411d13db59802e9d8b13e41a5d9727c499aa5cc7c8a1bc868d692c87b506e981dd0ad92e04cdc50988bda39172425724c24e6077c18b
SSDEEP 49152:oAmZBriFHc/c55EI2Xk6keUczlzHBsdp6v4m1:joiivIGVBJzHYp6v
TLSH
T18E859E127682C032F8D500F2967D5FBA5D2D6E251B3848DBA3E43DA599304D37B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69

File Explorer

820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69

.dll 1.7MB

820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69

IMPHASH 3e7bcbe0e071220bb82817798b846049
SHA256 820847c4c17c9bc7cc305823e40f81b7449e221b227459aae9afebf8033c6f69
MD5 d0f7d9956bd2bd8bf2be5a746ba5e7b6
SHA1 01fc0e3d2a456b93945064b75ad939447c93e470
SHA512 54f6dfa50ec3c94de98c411d13db59802e9d8b13e41a5d9727c499aa5cc7c8a1bc868d692c87b506e981dd0ad92e04cdc50988bda39172425724c24e6077c18b
SSDEEP 49152:oAmZBriFHc/c55EI2Xk6keUczlzHBsdp6v4m1:joiivIGVBJzHYp6v
TLSH
T18E859E127682C032F8D500F2967D5FBA5D2D6E251B3848DBA3E43DA599304D37B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1107909

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTempPathW InitializeCriticalSectionAndSpinCount DeleteFileW GetFileSizeEx CreateFileMappingW MapViewOfFile UnmapViewOfFile GetTickCount WaitForMultipleObjects MoveFileExW ResetEvent SwitchToThread TerminateProcess GetExitCodeProcess GetCurrentThread GetStartupInfoW OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesExW ReleaseMutex CreateMutexW Sleep CreatePipe GetModuleFileNameA FormatMessageA LoadLibraryA VerSetConditionMask VerifyVersionInfoW CreateThread lstrcmpA GetStdHandle ReadFile GetFileSize FlushFileBuffers LocalFree GetCurrentProcess WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA SetFilePointerEx GetConsoleCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFileType GetACP GetTimeZoneInformation WideCharToMultiByte GetFullPathNameW FindClose CopyFileW GetSystemTimeAsFileTime DeviceIoControl CreateFileW MultiByteToWideChar FindResourceW LoadLibraryW SetEvent lstrcmpiW SizeofResource LockResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetCurrentThreadId WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc CreateProcessA ExitProcess GetModuleHandleExW ExitThread RtlUnwind GetTickCount64 SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileA AreFileApisANSI HeapCreate InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetFileAttributesW GetVersionExW HeapAlloc HeapDestroy InterlockedFlushSList DuplicateHandle FreeLibraryAndExitThread SetLastError GetLastError RaiseException CloseHandle DecodePointer CreateEventW WriteFile QueryPerformanceCounter QueryPerformanceFrequency GetThreadTimes IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FormatMessageW TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo GetSystemTime SystemTimeToFileTime GetCurrentProcessId LockFileEx CreateFileMappingA UnlockFile HeapCompact GetSystemInfo DeleteFileA GetVersionExA WaitForSingleObjectEx CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapValidate

user32

DefWindowProcW GetMessageW TranslateMessage DispatchMessageW PeekMessageW UnregisterClassW RegisterClassExW GetClassInfoExW CreateWindowExW IsWindow DestroyWindow CharNextW SetWindowLongW LoadCursorW PostMessageW wsprintfW PostQuitMessage CallWindowProcW MsgWaitForMultipleObjects SetTimer DrawFocusRect ShowWindow SetCursor PostThreadMessageW GetParent ScreenToClient GetClientRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetAsyncKeyState SendMessageW GetWindowLongW KillTimer CopyRect OffsetRect UnionRect EqualRect PtInRect

gdi32

SaveDC SelectObject CreateDIBSection DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SetViewportOrgEx RectVisible OffsetViewportOrgEx GetObjectW DeleteObject RestoreDC

advapi32

RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation OpenProcessToken RegGetValueW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ord165

ole32

CoCreateInstance CoTaskMemRealloc CoTaskMemFree CoInitialize CoUninitialize CoCreateGuid CoTaskMemAlloc

oleaut32

SysStringLen VarUI4FromStr SysFreeString SysAllocStringLen

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW PathCombineW PathFindFileNameW PathIsRelativeW PathIsDirectoryW StrCmpNIW StrTrimA StrStrIA StrStrIW StrCmpIW PathFileExistsA

comctl32

_TrackMouseEvent

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wininet

InternetGetConnectedState

crypt32

CertGetNameStringW

iphlpapi

GetAdaptersInfo

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

gdiplus

GdipDeleteBrush GdipCreateSolidFill GdipGetImageWidth GdipCreateFromHDC GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectRect GdipGetImageHeight

generic

count=51, id=241, version=40116,

count=206, id=243, version=40116,

count=38, id=242, version=40116,

count=2, id=260, version=27034,

count=4, id=199, version=41118,

count=29, id=259, version=26706,

count=12, id=260, version=27051,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=11, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=49, id=261, version=27051,

count=36, id=260, version=26706,

count=126, id=261, version=26706,

count=1, id=209, version=65501,

count=6, id=206, version=65501,

count=1, id=208, version=65501,

count=39, id=203, version=65501,

count=444, id=1, productName=Unmarked objects,

count=32, id=260, version=27054,

count=90, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,