8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493

Sharing

Copy URL Twitter E-mail

General

Target
8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493
Size 2.1MB
Sample260825-nn2tcahp21
SHA256 8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493
MD5 b71af913001c35c40cbdc419ae69856b
SHA1 f7eac1b2fa702788d332701b4f0f04724e8019ef
SHA512 5c2a0675f642101d1ae2864c1c727b91946607ecb9ded901c95fb72087b68c8dc0296acaa47d9144060ec1ab4ad505c4ca04f4ea43d0ff839c19eed233103421
SSDEEP 49152:UEgjDuOCxRY99/27H1LJ1DS5+pYfyggKOt+97mxNEDwuOY1HP:UxjG4+93KOU5ZDwuO
TLSH
T195A5AF12F942C032E5E900B1567C9BBA496C2B340B3996D7B3D49DAA5D304D37B39B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493

File Explorer

8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493

.dll 2.1MB

8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493

IMPHASH 23edc85f57efac007329ab512efe7c9c
SHA256 8c648b64ac42045fbe04ff9b522154c146f4050a2f1d7a5187765423cdf65493
MD5 b71af913001c35c40cbdc419ae69856b
SHA1 f7eac1b2fa702788d332701b4f0f04724e8019ef
SHA512 5c2a0675f642101d1ae2864c1c727b91946607ecb9ded901c95fb72087b68c8dc0296acaa47d9144060ec1ab4ad505c4ca04f4ea43d0ff839c19eed233103421
SSDEEP 49152:UEgjDuOCxRY99/27H1LJ1DS5+pYfyggKOt+97mxNEDwuOY1HP:UxjG4+93KOU5ZDwuO
TLSH
T195A5AF12F942C032E5E900B1567C9BBA496C2B340B3996D7B3D49DAA5D304D37B39B2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1297525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\code\clean_master\base_module\basic\Build\bridge_framework.pdb

kernel32

DeleteFileW GetFileSizeEx CreateFileMappingW MapViewOfFile UnmapViewOfFile SetFileAttributesW GetTickCount WaitForMultipleObjects MoveFileExW ResetEvent SwitchToThread QueueUserWorkItem GetLogicalDriveStringsW GetLongPathNameW GetTempFileNameW QueryDosDeviceW TerminateProcess GetExitCodeProcess GetCurrentThread CreateProcessW GetStartupInfoW OpenProcess lstrlenW MoveFileW K32EnumProcesses K32GetModuleFileNameExW K32GetProcessImageFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindFirstFileW FindNextFileW VirtualAllocEx VirtualFreeEx ReadProcessMemory WriteProcessMemory FileTimeToLocalFileTime GetFileAttributesExW ReleaseMutex CreateMutexW OpenMutexW Sleep GetVersion CreatePipe GetModuleFileNameA FormatMessageA LoadLibraryA VerSetConditionMask VerifyVersionInfoW ProcessIdToSessionId lstrcmpW WTSGetActiveConsoleSessionId CreateThread CreateTimerQueue UnregisterWaitEx QueryDepthSList ReleaseSemaphore VirtualProtect GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority InitializeCriticalSectionAndSpinCount SignalObjectAndWait WritePrivateProfileStringW GetPrivateProfileStringW GetTempPathW LocalAlloc WriteConsoleW SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA GetConsoleCP SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetSystemTimeAsFileTime WriteFile ReadFile GetFileSize FlushFileBuffers LocalFree GetCurrentProcess GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime WideCharToMultiByte CopyFileW CreateDirectoryW DeviceIoControl CreateFileW MultiByteToWideChar FindResourceW LoadLibraryW lstrcmpiW SizeofResource LockResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary FindResourceExW GetCurrentThreadId WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc GetTimeFormatW GetDateFormatW GetFileType GetACP QueryPerformanceFrequency CreateProcessA DuplicateHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread InterlockedFlushSList RtlUnwind lstrcmpA GetSystemWindowsDirectoryW GetVolumeInformationW GetStdHandle SetFileTime GetTickCount64 SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileA SetEvent HeapAlloc TryEnterCriticalSection AreFileApisANSI HeapCreate GetFullPathNameW InterlockedCompareExchange GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx HeapDestroy SetLastError GetLastError RaiseException CloseHandle DecodePointer CreateEventW SetThreadPriority GetFileAttributesW GetVersionExW HeapValidate IsDebuggerPresent OutputDebugStringW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA FormatMessageW TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo QueryPerformanceCounter GetSystemTime SystemTimeToFileTime GetCurrentProcessId LockFileEx CreateFileMappingA UnlockFile HeapCompact GetSystemInfo DeleteFileA GetVersionExA WaitForSingleObjectEx CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA

user32

SetTimer KillTimer CharNextW DestroyWindow IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW UnregisterClassW MsgWaitForMultipleObjects PostThreadMessageW GetParent ScreenToClient GetClientRect InvalidateRect CallWindowProcW BeginPaint ReleaseDC GetDC ReleaseCapture SetCapture GetAsyncKeyState GetShellWindow IsWindowVisible GetWindow GetWindowThreadProcessId CopyRect OffsetRect UnionRect EqualRect PtInRect SetCursor ShowWindow DrawFocusRect FindWindowExW FindWindowW SendMessageW GetWindowLongW PostQuitMessage PeekMessageW DispatchMessageW TranslateMessage GetMessageW wsprintfW DefWindowProcW PostMessageW LoadCursorW SetWindowLongW EndPaint

gdi32

GetObjectW CreateDIBSection SelectObject OffsetViewportOrgEx RectVisible SaveDC RestoreDC DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SetViewportOrgEx

advapi32

GetTokenInformation RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW OpenProcessToken FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid OpenThreadToken RegQueryValueExW LookupPrivilegeValueW SetTokenInformation GetLengthSid DuplicateTokenEx CreateWellKnownSid AdjustTokenPrivileges ConvertSidToStringSidA RegGetValueA RegOpenKeyExA RegGetValueW

shell32

SHFileOperationW ShellExecuteExW SHGetFolderPathW SHChangeNotify SHCreateDirectoryExW SHGetSpecialFolderPathW ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW ord165

ole32

CoCreateGuid StringFromGUID2 CoUninitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc

oleaut32

VariantClear SysAllocString SysAllocStringLen SysFreeString VarDateFromStr VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VarUI4FromStr

shlwapi

PathAppendW PathRemoveFileSpecW SHGetValueW AssocQueryStringW PathCombineW PathFindFileNameW PathIsRelativeW PathIsRootW StrTrimA StrCmpNIW PathIsDirectoryW StrStrIW StrStrIA StrCmpIW PathFindExtensionW PathFileExistsA PathFileExistsW

comctl32

_TrackMouseEvent

wtsapi32

WTSQueryUserToken

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

dbghelp

MakeSureDirectoryPathExists

wininet

InternetGetConnectedState InternetCrackUrlW

crypt32

CertGetNameStringW

iphlpapi

GetAdaptersInfo

wintrust

WTHelperProvDataFromStateData WinVerifyTrust

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

gdiplus

GdipCreateFromHDC GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectRect GdipGetImageHeight GdipCreateSolidFill GdipDeleteBrush GdipGetImageWidth

bcrypt

BCryptGenRandom

generic

count=51, id=241, version=40116,

count=201, id=243, version=40116,

count=38, id=242, version=40116,

count=2, id=260, version=27034,

count=3, id=199, version=41118,

count=29, id=259, version=26706,

count=12, id=260, version=27051,

count=1, id=260, productName=VS2017 v15.9.11 build 27030, version=27030,

count=11, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=49, id=261, version=27051,

count=36, id=260, version=26706,

count=122, id=261, version=26706,

count=1, id=209, version=65501,

count=6, id=206, version=65501,

count=1, id=208, version=65501,

count=41, id=203, version=65501,

count=442, id=1, productName=Unmarked objects,

count=32, id=260, version=27054,

count=54, id=261, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,