d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1

Sharing

Copy URL Twitter E-mail

General

Target
d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1
Size 806KB
Sample260825-xjcs4avsdv
SHA256 d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1
MD5 07c7b7ed55b65ba20708b4b99542f1c4
SHA1 b2bdb856475cdb613595e329c58f4386fcf7b23c
SHA512 bf974de64e84c5d8cd87400a1506d358f42700ed3da1c9e4bfd82c7312081683ff850e50128c1c05647a4790bf0db2ef437163c51ce8bc4ce127fdd2484bcbee
SSDEEP 24576:+UbHGuXHMJ6WbzcUFf6mflRKPNidlOraknYdpK:PHG7LgRnYdpK
TLSH
T13D05F905F6FB5EE5F9B76FB0167AE29F0A3D79108431CF4F960408591A32D90AE60F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1

File Explorer

d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1

.dll 806KB

d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1

IMPHASH 596d082ef1e72f82e4e5fa5972d624dd
SHA256 d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1
MD5 07c7b7ed55b65ba20708b4b99542f1c4
SHA1 b2bdb856475cdb613595e329c58f4386fcf7b23c
SHA512 bf974de64e84c5d8cd87400a1506d358f42700ed3da1c9e4bfd82c7312081683ff850e50128c1c05647a4790bf0db2ef437163c51ce8bc4ce127fdd2484bcbee
SSDEEP 24576:+UbHGuXHMJ6WbzcUFf6mflRKPNidlOraknYdpK:PHG7LgRnYdpK
TLSH
T13D05F905F6FB5EE5F9B76FB0167AE29F0A3D79108431CF4F960408591A32D90AE60F22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

368608

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlNtStatusToDosError RtlRaiseException vDbgPrintExWithPrefix

advapi32

CryptAcquireContextA CryptAcquireContextW CryptContextAddRef CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyHash CryptDestroyKey CryptEncrypt CryptEnumProvidersW CryptExportKey CryptGenKey CryptGenRandom CryptGetHashParam CryptGetKeyParam CryptGetProvParam CryptGetUserKey CryptHashData CryptImportKey CryptReleaseContext CryptSetProvParam CryptSignHashW CryptVerifySignatureW GetUserNameA RegCloseKey RegCreateKeyA RegCreateKeyExA RegCreateKeyExW RegCreateKeyW RegDeleteKeyA RegDeleteKeyW RegEnumKeyA RegEnumKeyExW RegEnumKeyW RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW

advapi32_vista

RegDeleteTreeW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptDestroyKey BCryptFinishHash BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptVerifySignature

kernel32

CloseHandle CompareFileTime CreateFileA CreateFileW CreateSemaphoreW DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection FileTimeToSystemTime FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetEnvironmentVariableA GetFileSize GetLastError GetLocaleInfoA GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LocalReAlloc MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RtlUnwind SetFilePointer SetFilePointerEx SetLastError SetUnhandledExceptionFilter Sleep SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcatW lstrcmpA lstrcmpiW lstrcpyA lstrcpyW lstrlenA lstrlenW

kernel32_vista

InitializeCriticalSectionEx

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _strnicmp _unlock _vsnprintf _vsnwprintf abort bsearch calloc free fwrite isspace iswctype malloc memchr memcmp memcpy memmove memset qsort realloc sprintf sscanf strchr strcmp strcpy strcspn strlen strncmp strstr towlower vfprintf wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr strtol _wcsnicmp _wcslwr _wcsicmp _stricmp

user32

CharNextA LoadStringW wsprintfW

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddCertificateLinkToStore CertAddEncodedCRLToStore CertAddEncodedCTLToStore CertAddEncodedCertificateToStore CertAddEncodedCertificateToSystemStoreA CertAddEncodedCertificateToSystemStoreW CertAddEnhancedKeyUsageIdentifier CertAddSerializedElementToStore CertAddStoreToCollection CertAlgIdToOID CertCloseStore CertCompareCertificate CertCompareCertificateName CertCompareIntegerBlob CertComparePublicKeyInfo CertControlStore CertCreateCRLContext CertCreateCTLContext CertCreateCertificateChainEngine CertCreateCertificateContext CertCreateContext CertCreateSelfSignCertificate CertDeleteCRLFromStore CertDeleteCTLFromStore CertDeleteCertificateFromStore CertDuplicateCRLContext CertDuplicateCTLContext CertDuplicateCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertEnumCRLContextProperties CertEnumCRLsInStore CertEnumCTLContextProperties CertEnumCTLsInStore CertEnumCertificateContextProperties CertEnumCertificatesInStore CertEnumPhysicalStore CertEnumSystemStore CertEnumSystemStoreLocation CertFindAttribute CertFindCRLInStore CertFindCTLInStore CertFindCertificateInCRL CertFindCertificateInStore CertFindChainInStore CertFindExtension CertFindRDNAttr CertFindSubjectInCTL CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCRLContextProperty CertGetCRLFromStore CertGetCTLContextProperty CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertGetIssuerCertificateFromStore CertGetNameStringA CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetSubjectCertificateFromStore CertGetValidUsages CertIsRDNAttrsInCertificateName CertIsValidCRLForCertificate CertNameToStrA CertNameToStrW CertOIDToAlgId CertOpenStore CertOpenSystemStoreA CertOpenSystemStoreW CertRDNValueToStrA CertRDNValueToStrW CertRegisterPhysicalStore CertRegisterSystemStore CertRemoveEnhancedKeyUsageIdentifier CertRemoveStoreFromCollection CertSaveStore CertSerializeCRLStoreElement CertSerializeCTLStoreElement CertSerializeCertificateStoreElement CertSetCRLContextProperty CertSetCTLContextProperty CertSetCertificateContextProperty CertSetEnhancedKeyUsage CertSetStoreProperty CertStrToNameA CertStrToNameW CertUnregisterPhysicalStore CertUnregisterSystemStore CertVerifyCRLRevocation CertVerifyCRLTimeValidity CertVerifyCTLUsage CertVerifyCertificateChainPolicy CertVerifyRevocation CertVerifySubjectCertificateContext CertVerifyTimeValidity CertVerifyValidityNesting CreateFileU CryptAcquireCertificatePrivateKey CryptAcquireContextU CryptBinaryToStringA CryptBinaryToStringW CryptCloseAsyncHandle CryptCreateAsyncHandle CryptDecodeMessage CryptDecodeObject CryptDecodeObjectEx CryptDecryptAndVerifyMessageSignature CryptDecryptMessage CryptEncodeObject CryptEncodeObjectEx CryptEncryptMessage CryptEnumOIDFunction CryptEnumOIDInfo CryptEnumProvidersU CryptExportPKCS8 CryptExportPublicKeyInfo CryptExportPublicKeyInfoEx CryptFindCertificateKeyProvInfo CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptFreeOIDFunctionAddress CryptGetAsyncParam CryptGetDefaultOIDDllList CryptGetDefaultOIDFunctionAddress CryptGetMessageCertificates CryptGetMessageSignerCount CryptGetOIDFunctionAddress CryptGetOIDFunctionValue CryptHashCertificate CryptHashMessage CryptHashPublicKeyInfo CryptHashToBeSigned CryptImportPKCS8 CryptImportPublicKeyInfo CryptImportPublicKeyInfoEx CryptInitOIDFunctionSet CryptInstallOIDFunctionAddress CryptLoadSip CryptMemAlloc CryptMemFree CryptMemRealloc CryptMsgCalculateEncodedLength CryptMsgClose CryptMsgControl CryptMsgCountersign CryptMsgCountersignEncoded CryptMsgDuplicate CryptMsgEncodeAndSignCTL CryptMsgGetAndVerifySigner CryptMsgGetParam CryptMsgOpenToDecode CryptMsgOpenToEncode CryptMsgSignCTL CryptMsgUpdate CryptMsgVerifyCountersignatureEncoded CryptMsgVerifyCountersignatureEncodedEx CryptProtectData CryptProtectMemory CryptQueryObject CryptRegisterDefaultOIDFunction CryptRegisterOIDFunction CryptRegisterOIDInfo CryptSIPAddProvider CryptSIPCreateIndirectData CryptSIPGetSignedDataMsg CryptSIPLoad CryptSIPPutSignedDataMsg CryptSIPRemoveProvider CryptSIPRemoveSignedDataMsg CryptSIPRetrieveSubjectGuid CryptSIPRetrieveSubjectGuidForCatalogFile CryptSIPVerifyIndirectData CryptSetAsyncParam CryptSetKeyIdentifierProperty CryptSetOIDFunctionValue CryptSetProviderU CryptSignAndEncodeCertificate CryptSignAndEncryptMessage CryptSignCertificate CryptSignHashU CryptSignMessage CryptSignMessageWithKey CryptStringToBinaryA CryptStringToBinaryW CryptUnprotectData CryptUnprotectMemory CryptUnregisterDefaultOIDFunction CryptUnregisterOIDFunction CryptUnregisterOIDInfo CryptVerifyCertificateSignature CryptVerifyCertificateSignatureEx CryptVerifyDetachedMessageHash CryptVerifyDetachedMessageSignature CryptVerifyMessageHash CryptVerifyMessageSignature CryptVerifyMessageSignatureWithKey CryptVerifySignatureU I_CertUpdateStore I_CryptAllocTls I_CryptCreateLruCache I_CryptCreateLruEntry I_CryptDetachTls I_CryptFindLruEntry I_CryptFindLruEntryData I_CryptFlushLruCache I_CryptFreeLruCache I_CryptFreeTls I_CryptGetAsn1Decoder I_CryptGetAsn1Encoder I_CryptGetDefaultCryptProv I_CryptGetDefaultCryptProvForEncrypt I_CryptGetOssGlobal I_CryptGetTls I_CryptInsertLruEntry I_CryptInstallAsn1Module I_CryptInstallOssGlobal I_CryptReadTrustedPublisherDWORDValueFromRegistry I_CryptReleaseLruEntry I_CryptSetTls I_CryptUninstallAsn1Module I_CryptUninstallOssGlobal PFXExportCertStore PFXExportCertStoreEx PFXImportCertStore PFXIsPFXBlob PFXVerifyPassword RegCreateHKCUKeyExU RegCreateKeyExU RegDeleteValueU RegEnumValueU RegOpenHKCUKeyExU RegOpenKeyExU RegQueryInfoKeyU RegQueryValueExU RegSetValueExU

Name

.text

Size

361KB

Virtual Size

360KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d9d61b3bd13201a47dbc7d56ab8dfb2e47160aacf90d85290836fef96e43efe1

ntdll

advapi32

advapi32_vista

bcrypt

kernel32

kernel32_vista

msvcrt

user32

generic