3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca

Sharing

Copy URL Twitter E-mail

General

Target
3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca
Size 2.0MB
Sample260825-w665sadn2w
SHA256 3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca
MD5 47866e46dbb5ad0c0af013bee2b57fa2
SHA1 b013327418df3bd1fef5acc4238c6d9a2fdc8ad8
SHA512 3c788eb65ccff337391913420f5cc5df1f5eb172d509dbf343c5f314548183422535ffc18afeab1bbba7ba293b3611a0fec947e7402fd32f289cc1603e8cff27
SSDEEP 49152:qdHbfe6bKLawC2Ds0yHW6ukBKMU2ifeLTeZ2v1G6w5Lo+2rtEAGfEqLOQ+q8KZV:Ue6H/ifYNGNcbtEABVQ
TLSH
T182A5BF11B681C132E9EF01358ABEAB7E467CB6310B6590DBA7C41D6D5E706E27B3130B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca

File Explorer

3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca

.dll 2.0MB

3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca

IMPHASH 66a8ba5e19e59de5891813a407c4b730
SHA256 3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca
MD5 47866e46dbb5ad0c0af013bee2b57fa2
SHA1 b013327418df3bd1fef5acc4238c6d9a2fdc8ad8
SHA512 3c788eb65ccff337391913420f5cc5df1f5eb172d509dbf343c5f314548183422535ffc18afeab1bbba7ba293b3611a0fec947e7402fd32f289cc1603e8cff27
SSDEEP 49152:qdHbfe6bKLawC2Ds0yHW6ukBKMU2ifeLTeZ2v1G6w5Lo+2rtEAGfEqLOQ+q8KZV:Ue6H/ifYNGNcbtEABVQ
TLSH
T182A5BF11B681C132E9EF01358ABEAB7E467CB6310B6590DBA7C41D6D5E706E27B3130B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

440503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\work\stcode\newDesktopIcon\bin\core.pdb

ws2_32

closesocket gethostbyname inet_addr getsockname socket connect htons

kernel32

CreateFileW ReleaseMutex MultiByteToWideChar CreateFileA DeleteFileA DeleteFileW CreateThread GetShortPathNameA GetCurrentProcess GetCurrentThreadId GetLocalTime GetCurrentProcessId SetUnhandledExceptionFilter GetComputerNameA GetModuleFileNameA FindFirstFileA FindNextFileA InitializeCriticalSectionEx FindClose RaiseException LoadLibraryW SetFileAttributesA DecodePointer GetProcAddress DeleteCriticalSection WideCharToMultiByte lstrcpyW UpdateResourceA VirtualQuery SizeofResource BeginUpdateResourceA FindResourceA GetModuleHandleA CopyFileA LoadLibraryA LockResource LoadResource WinExec CreateProcessA EndUpdateResourceA FreeLibrary FormatMessageA GetModuleFileNameW GetCurrentDirectoryW SetCurrentDirectoryW ExitProcess HeapFree GetFullPathNameW WaitForSingleObject HeapSize HeapReAlloc WriteFile GetProcessHeap GetModuleHandleW MoveFileExW GetExitCodeProcess SetStdHandle ReadConsoleW CreateDirectoryW GetFileAttributesExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadFile GetTickCount GlobalFree GlobalAlloc GetLastError Sleep SetLastError GetProcessTimes lstrcmpiA FileTimeToLocalFileTime CloseHandle Process32Next FileTimeToSystemTime CreateToolhelp32Snapshot OpenProcess Process32First CreatePipe IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetFileSizeEx GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent CreateMutexA SetEndOfFile SetFilePointer GetCPInfo GetStringTypeW IsValidLocale GetTimeFormatW GetDateFormatW GetTempPathW GetStdHandle SetEnvironmentVariableW CreateProcessW DuplicateHandle QueryPerformanceFrequency SystemTimeToFileTime TzSpecificLocalTimeToSystemTime SetFileTime PeekNamedPipe GetFileType GetFileInformationByHandle GetDriveTypeW UnlockFileEx LockFileEx WriteConsoleW SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW GetCommandLineW GetCommandLineA GetModuleHandleExW InterlockedFlushSList LoadLibraryExW RtlUnwind OutputDebugStringW FreeEnvironmentStringsW HeapAlloc RemoveDirectoryW EnterCriticalSection LeaveCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW GetComputerNameW

user32

GetForegroundWindow LoadStringW GetShellWindow GetWindowRect MessageBoxA GetDesktopWindow

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

SHChangeNotify SHGetFolderPathA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

ole32

CoInitialize CoCreateInstance CoTaskMemFree

oleaut32

SysFreeString SysAllocString VariantClear

iphlpapi

GetAdaptersInfo SendARP

rpcrt4

UuidCreateSequential

winhttp

WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable WinHttpSendRequest

shlwapi

PathFindFileNameA PathRemoveExtensionA PathAppendA PathFileExistsW

dbghelp

MakeSureDirectoryPathExists MiniDumpWriteDump

wininet

HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetOpenW InternetCheckConnectionW InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile InternetConnectW

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

winmm

timeGetTime

fltlib

FilterSendMessage

Name

.text

Size

645KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

188KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

532B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

980KB

Virtual Size

979KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3d4c58e8edf5abe4c062452854619f31f8138b7292516abaa6ec0c6cd80fc4ca

ws2_32

kernel32

user32

advapi32

shell32

ole32

oleaut32

iphlpapi

rpcrt4

winhttp

shlwapi

dbghelp

wininet

version

winmm

fltlib

generic