15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4

Sharing

Copy URL Twitter E-mail

General

Target
15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4
Size 2.7MB
Sample260825-t8mstaaa34
SHA256 15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4
MD5 9058778f2b690dac195313ecfde5425b
SHA1 fef0f06d43d47d2b78458365d523de58f434e593
SHA512 4adb312356144e50420fff1d2b76d54f22e8625d080f44d6f57994ec5c4938c597c64f7e1d1fe289601492622a5b2ad156129306371fb2aba6f3f5d4923fa480
SSDEEP 49152:Kk9zsHx6w3QYm2sdF2aTACk+SP+YC+sMb5PWOp27:Kk9zKfgzFF2aMj+iP
TLSH
T125D5C0C2F7C28165E4C2043855B6E73E6D3A5A248F69C5E3DAC088FB4C396D1263E76D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4

File Explorer

15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4

.dll 2.7MB

15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4

IMPHASH 72c5e837a889e16fea7ca4bfa8e6f9e7
SHA256 15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4
MD5 9058778f2b690dac195313ecfde5425b
SHA1 fef0f06d43d47d2b78458365d523de58f434e593
SHA512 4adb312356144e50420fff1d2b76d54f22e8625d080f44d6f57994ec5c4938c597c64f7e1d1fe289601492622a5b2ad156129306371fb2aba6f3f5d4923fa480
SSDEEP 49152:Kk9zsHx6w3QYm2sdF2aTACk+SP+YC+sMb5PWOp27:Kk9zKfgzFF2aMj+iP
TLSH
T125D5C0C2F7C28165E4C2043855B6E73E6D3A5A248F69C5E3DAC088FB4C396D1263E76D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1539248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

inet_ntoa inet_ntop closesocket WSASetLastError send recv WSAGetLastError WSACleanup

kernel32

AcquireSRWLockShared ReadFile QueryDosDeviceW GetFileSizeEx VirtualProtect VirtualFree GetCurrentProcess WriteFile K32GetMappedFileNameA SetFilePointer QueryDosDeviceA CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA GetCommandLineA GetLogicalDriveStringsW K32GetModuleFileNameExA GetLastError CreateFileA GetVersionExA CloseHandle GetSystemInfo GetLogicalDriveStringsA GetProcAddress CreateFileMappingA GetFileSize GetCurrentProcessId WideCharToMultiByte CreateDirectoryA GetSystemTime K32GetMappedFileNameW MapViewOfFile VirtualQuery DuplicateHandle GetCurrentThread GetThreadContext SetThreadContext OpenThread K32GetProcessImageFileNameA OpenProcess CreateProcessW IsWow64Process VirtualQueryEx OutputDebugStringA FormatMessageA LoadLibraryA MoveFileA GetFullPathNameA SetEndOfFile DeleteFileA CreateToolhelp32Snapshot VirtualProtectEx ReadProcessMemory K32EnumProcessModules InitializeCriticalSectionEx MultiByteToWideChar RaiseException DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW FindFirstFileA ReleaseSRWLockShared FindClose HeapCreate GetCommandLineW InitializeCriticalSection SetErrorMode AddVectoredExceptionHandler SetUnhandledExceptionFilter Thread32Next Thread32First SuspendThread ResumeThread EnterCriticalSection FindNextFileW lstrlenW LeaveCriticalSection GetFileAttributesW GetFileAttributesA ExitThread FileTimeToSystemTime SystemTimeToFileTime GetProcessIdOfThread TryEnterCriticalSection GetVolumeInformationA GetVolumeNameForVolumeMountPointA GetTempPathA GetWindowsDirectoryA CreateEventA GetComputerNameA GetFullPathNameW GetLongPathNameW OpenMutexA LocalFree GetLongPathNameA CallNamedPipeW OpenEventA WaitForSingleObject Sleep SetEvent CreateThread ExitProcess HeapDestroy TlsSetValue TlsAlloc TlsGetValue TlsFree QueryPerformanceFrequency QueryPerformanceCounter GetStdHandle GetFileType SwitchToThread InitializeCriticalSectionAndSpinCount GetModuleHandleExW DeleteFiber ConvertFiberToThread FreeLibrary LoadLibraryW FindFirstFileW GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FlsFree FlsSetValue FlsGetValue FlsAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive EncodePointer GetModuleFileNameW SetLastError InitOnceExecuteOnce HeapAlloc HeapReAlloc HeapFree CompareStringW LCMapStringW HeapSize GetConsoleOutputCP SetFilePointerEx SetStdHandle GetTimeZoneInformation FlushFileBuffers GetCurrentDirectoryW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DecodePointer FindNextFileA SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler WriteConsoleW LoadLibraryExW InterlockedFlushSList RtlUnwind OutputDebugStringW InitializeSListHead UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetStringTypeW

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptReleaseContext CryptDestroyHash CryptCreateHash CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetKeyValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenProcessToken ConvertSidToStringSidW GetTokenInformation RegQueryValueExA GetUserNameA RegOpenKeyExA CloseServiceHandle OpenSCManagerW GetServiceKeyNameW QueryServiceConfigW RegCloseKey

ole32

CoCreateFreeThreadedMarshaler StringFromGUID2

oleaut32

SysStringLen

shlwapi

PathRemoveFileSpecA PathRemoveFileSpecW PathAppendA

bcrypt

BCryptGenRandom

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

587KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

386KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

118KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

15beaa89100add6e2e4a728ff06eeaee9a1591e03bd9ca6e4625eeb78e5091c4

crypt32

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

bcrypt

generic