6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf

Sharing

Copy URL Twitter E-mail

General

Target
6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf
Size 445KB
Sample260825-xc7pwsae49
SHA256 6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf
MD5 35014202ddc8b36bede224d495404fa2
SHA1 04aef913236702138eb9593b4f0028dc1d41b88d
SHA512 c2792feeb511b745fbbb9eb5548d3b0a19d320d269e444d44d8f67e18c741f46951054d619de0b83c9e26c68ceb88df2af08d1b5bf2189557d9b50b69cfbc3ca
SSDEEP 6144:QGRbJvN+rfdO6XqT6h5KHHHHHHDmZyUBHZHn0HqiHHHHZkWp0aC660p:7FN61rIHHHHHHDmZyUBHZH0HVHHHHqs/
TLSH
T11AA44B51BAC5CDE6E9551278DCBEE7DA053C7CE05922CF5BA2A43D3B0A326C1A9C0743
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf

File Explorer

6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf

.exe 445KB

6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf

IMPHASH 3091844769892ece66d002eb861492e1
SHA256 6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf
MD5 35014202ddc8b36bede224d495404fa2
SHA1 04aef913236702138eb9593b4f0028dc1d41b88d
SHA512 c2792feeb511b745fbbb9eb5548d3b0a19d320d269e444d44d8f67e18c741f46951054d619de0b83c9e26c68ceb88df2af08d1b5bf2189557d9b50b69cfbc3ca
SSDEEP 6144:QGRbJvN+rfdO6XqT6h5KHHHHHHDmZyUBHZHn0HqiHHHHZkWp0aC660p:7FN61rIHHHHHHDmZyUBHZH0HVHHHHqs/
TLSH
T11AA44B51BAC5CDE6E9551278DCBEE7DA053C7CE05922CF5BA2A43D3B0A326C1A9C0743
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

112752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptExportKey CryptGetHashParam CryptHashData CryptImportKey CryptReleaseContext CryptSetHashParam RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW GetSaveFileNameW

crypt32

CertCreateCertificateContext CertFreeCertificateContext CertVerifySubjectCertificateContext CryptImportPublicKeyInfoEx CryptMemAlloc CryptMemFree

kernel32

CloseHandle CreateFileW DeleteCriticalSection EnterCriticalSection FormatMessageW GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileSize GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree QueryPerformanceCounter ReadFile SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WriteFile lstrlenW

msvcrt

__dllonexit __lconv_init __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snprintf _snwprintf _unlock _wcmdln _wtoi abort atoi calloc exit fprintf free fwrite gmtime localtime malloc memcmp memcpy memmove memset mktime printf putchar rand realloc signal sprintf strcat strcpy strlen strncmp strncpy strtok swprintf time vfprintf vsprintf wcscat wcscmp wcscpy wcslen wcsncmp wcstok

ole32

CoTaskMemFree

secur32

AcquireCredentialsHandleW DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextA QueryContextAttributesW QueryCredentialsAttributesA

shell32

SHGetFolderLocation SHGetPathFromIDListW

ws2_32

WSAAsyncSelect WSACleanup WSAGetLastError WSAStartup closesocket connect gethostbyname getpeername getsockname getsockopt htons inet_addr recv select send setsockopt socket

gdi32

BitBlt CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateICW CreatePen CreateRectRgn CreateSolidBrush DPtoLP DeleteDC DeleteObject GetDeviceCaps GetObjectW IntersectClipRect LineTo MoveToEx SelectClipRgn SelectObject SetBkMode SetTextColor StretchBlt

user32

AdjustWindowRectEx BeginPaint BringWindowToTop CreateCursor CreateDialogParamW CreateWindowExW DefWindowProcW DestroyCursor DestroyIcon DialogBoxParamW DispatchMessageW DrawTextW EndDialog EndPaint EnumDisplayDevicesW EnumDisplaySettingsExW FillRect GetClientRect GetDlgItem GetDlgItemTextW GetKeyState GetMessageW GetSystemMetrics GetWindowDC GetWindowLongW IntersectRect InvalidateRgn IsRectEmpty LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient ScrollWindowEx SendDlgItemMessageW SendMessageW SetCursor SetDlgItemTextW SetScrollPos SetScrollRange SetTimer SetWindowLongW SetWindowPos ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6672ef930e9619ff239a6033367e578644165e4d514853c6107fedb46287d7bf

advapi32

comctl32

comdlg32

crypt32

kernel32

msvcrt

ole32

secur32

shell32

ws2_32

gdi32

user32

generic