4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac

Sharing

Copy URL Twitter E-mail

General

Target
4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac
Size 3.0MB
Sample260825-tx2gtsstft
SHA256 4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac
MD5 cfa99b544dfe53ceba67872f71ac6953
SHA1 fce95486ea4ca90cffe378b1cce2b638c3bba33d
SHA512 6e38fe593b04770288d710a7a2d3d18b8e92f069a69c1d5bdb775ba6f327144c5759c97190972ae5596a17e6923bf26a0176fbda66ce620e34d945669caeee6b
SSDEEP 49152:aptrkEhhC/Yze95b4a2lvuxIS9Ag3l1iEmpbWmCufG7NKL:rEnTze950vlWxr1yHfONKL
TLSH
T14AE58D11F8018036E9E1127592EDABFA597C5631132E78E3E3E15CF81D606E27A3A71F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac

File Explorer

4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac

.exe 3.0MB

4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac

IMPHASH 181606fecff62c31ff13584dc1db1c57
SHA256 4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac
MD5 cfa99b544dfe53ceba67872f71ac6953
SHA1 fce95486ea4ca90cffe378b1cce2b638c3bba33d
SHA512 6e38fe593b04770288d710a7a2d3d18b8e92f069a69c1d5bdb775ba6f327144c5759c97190972ae5596a17e6923bf26a0176fbda66ce620e34d945669caeee6b
SSDEEP 49152:aptrkEhhC/Yze95b4a2lvuxIS9Ag3l1iEmpbWmCufG7NKL:rEnTze950vlWxr1yHfONKL
TLSH
T14AE58D11F8018036E9E1127592EDABFA597C5631132E78E3E3E15CF81D606E27A3A71F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2013116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

timeKillEvent auxGetVolume auxGetNumDevs auxGetDevCapsA mciSendCommandA waveOutGetNumDevs waveOutGetDevCapsA waveOutGetVolume timeGetTime

imm32

ImmIsIME

ws2_32

setsockopt connect WSACleanup shutdown WSAWaitForMultipleEvents WSAEnumNetworkEvents recv WSAStartup send htons inet_addr gethostbyname WSAGetLastError socket ioctlsocket WSACreateEvent closesocket WSAEventSelect WSACloseEvent

kernel32

SetStdHandle LoadLibraryW InterlockedExchange GetTickCount lstrcpynA lstrcatA CreateDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA MultiByteToWideChar GetModuleFileNameA CloseHandle WriteFile CreateFileA Sleep GetCurrentProcess SetPriorityClass IsBadReadPtr GetModuleHandleA SetCurrentDirectoryA GetCommandLineA CompareStringA lstrlenA DeleteFileA VirtualFree VirtualAlloc GetCurrentDirectoryA FindClose FindNextFileA FindFirstFileA WideCharToMultiByte lstrcmpiA SetEnvironmentVariableA GetSystemInfo lstrcpyW _lopen _lread _lwrite _llseek _lclose SetEndOfFile GetProcessHeap GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetModuleFileNameW HeapCreate GetConsoleMode GetConsoleCP GetDriveTypeW GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle GetStringTypeW LCMapStringW SetFilePointer DeleteCriticalSection GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount ReadFile GetTimeZoneInformation HeapSize GetCurrentThreadId VirtualQuery SetLastError TlsFree TlsSetValue WriteConsoleW CreateFileW TlsGetValue TlsAlloc IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateThread GlobalMemoryStatus GetFileAttributesA GetFileSize SetFileAttributesA CompareStringW InitializeCriticalSection GetProcessTimes RaiseException RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetLastError FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA GetFullPathNameA HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection HeapReAlloc HeapSetInformation GetStartupInfoW GetProcAddress GetModuleHandleW ExitProcess TerminateProcess

user32

ClientToScreen GetClientRect ShowCursor MessageBoxA wsprintfW GetWindowRect GetDlgItem GetDlgItemTextA InvalidateRect GetWindowDC ReleaseDC LoadCursorA LoadIconA RegisterClassA CreateWindowExA PostQuitMessage BeginPaint EndPaint PostMessageA DefWindowProcA ShowWindow GetWindowLongA OffsetRect SetRect GetSystemMetrics SetWindowPos GetKeyboardLayout GetKeyState GetKeyboardState IsIconic GetForegroundWindow GetAsyncKeyState SetForegroundWindow SetFocus SetWindowTextW SetWindowTextA wsprintfA GetDC PeekMessageA DispatchMessageA TranslateMessage GetMessageA MapVirtualKeyA GetClipboardData SetWindowLongA CloseClipboard OpenClipboard GetParent

gdi32

SetStretchBltMode GetStockObject StretchDIBits GetDeviceCaps DeleteObject CreatePalette SelectPalette RealizePalette

ole32

CoInitialize CoUninitialize

ddraw

DirectDrawCreate

dsound

ord1

comdlg32

GetSaveFileNameA GetOpenFileNameA

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

431KB

Virtual Size

35.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4c5665d6f51e7d1214d684d0e9d767cf29b5b9faa06c289b4df085971b2f13ac

winmm

imm32

ws2_32

kernel32

user32

gdi32

ole32

ddraw

dsound

comdlg32

generic