bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411

Sharing

Copy URL Twitter E-mail

General

Target
bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411
Size 913KB
Sample260825-xe1pcsae62
SHA256 bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411
MD5 41a4db4f0045b52faae32cc301b58c06
SHA1 1290bc1a6f99403f66006d962d8f6750ecc379e1
SHA512 7883f0138560eed53321342369c9f33fb7f3722ef37f3db7df046ea21c9c788f4bfce912956ecc71fc41d63f6d2526f48d1ad19303acf3095ac31e835f0e8018
SSDEEP 12288:O3K8AkYF5qk1E5zkEkeVVAGJH4JvFquK2+c3wrhoelIiKBDu5F1wwE9Ducd6hL6w:mK8ShC2oMOTGKf64jX
TLSH
T1F3153811B1EA95F2EAB7267549BBE7FB05397C608831DF5FA118180E9F33EC09914722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411

File Explorer

bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411

.dll 913KB

bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411

IMPHASH f87ce2e3209a8d811403837dd6ef41f5
SHA256 bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411
MD5 41a4db4f0045b52faae32cc301b58c06
SHA1 1290bc1a6f99403f66006d962d8f6750ecc379e1
SHA512 7883f0138560eed53321342369c9f33fb7f3722ef37f3db7df046ea21c9c788f4bfce912956ecc71fc41d63f6d2526f48d1ad19303acf3095ac31e835f0e8018
SSDEEP 12288:O3K8AkYF5qk1E5zkEkeVVAGJH4JvFquK2+c3wrhoelIiKBDu5F1wwE9Ducd6hL6w:mK8ShC2oMOTGKf64jX
TLSH
T1F3153811B1EA95F2EAB7267549BBE7FB05397C608831DF5FA118180E9F33EC09914722
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

507232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ntdll

vDbgPrintExWithPrefix

advapi32

SystemFunction036

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FileTimeToLocalFileTime FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentVariableA GetEnvironmentVariableW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetNumberFormatW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetTimeZoneInformation HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MultiByteToWideChar QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte lstrlenW

msvcrt

__dllonexit _amsg_exit _finite _initterm _iob _itow _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf abort acos asin atan atan2 bsearch calloc cos exp floor fmod free fwrite isalnum iswctype log log10 malloc memcmp memcpy memmove memset pow realloc sin sprintf sqrt strchr strcmp strcpy strcspn strlen strncmp tan towlower towupper vfprintf wcschr wcscmp wcscpy wcsncmp wcsstr wcstol _wcsnicmp _wcsicmp _wcsdup

ole32

CLSIDFromProgID CoGetClassObject CoTaskMemFree

oleaut32

LoadRegTypeLib SafeArrayAccessData SafeArrayCopy SafeArrayDestroy SafeArrayGetDim SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysStringLen VarUdateFromDate VariantChangeTypeEx VariantClear VariantCopy VariantInit

user32

LoadStringW

Name

.text

Size

497KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

164B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bb1987fabdf0f6b9e1ef069225c6b9c32c74825b23c5e57732359030180f8411

ntdll

advapi32

kernel32

msvcrt

ole32

oleaut32

user32

generic