84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48

Sharing

Copy URL Twitter E-mail

General

Target
84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48
Size 2.9MB
Sample260826-d26pcasama
SHA256 84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48
MD5 16caf5ceffc226d19e298f8a2b411a4a
SHA1 e623e347b24889adc54e84c71c06c8bc66e4ec90
SHA512 6dffbb1dc90d95ea5337436eefddc615363399d574c074f49f82fa2cc4298fcd1e983192f04bf78233b6800c9bab5b3666b609d7b5241f04fdbddfa2b61dcc59
SSDEEP 49152:L+xaF9hutujvOOzu9Gb06+kpYtGU48/MlfR648A9Em029WAdgnMS:T9hutsLy406+kpYtGKMlfRt39Cuyn
TLSH
T11BE5AE21B7B2C075C25652308A29FBBA51BCEE318B3199C763C47E6F7E309D1D23561A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48

File Explorer

84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48

.exe 2.9MB

84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48

IMPHASH 9904c5d61de0e5ae5f4ffd8ad90e1449
SHA256 84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48
MD5 16caf5ceffc226d19e298f8a2b411a4a
SHA1 e623e347b24889adc54e84c71c06c8bc66e4ec90
SHA512 6dffbb1dc90d95ea5337436eefddc615363399d574c074f49f82fa2cc4298fcd1e983192f04bf78233b6800c9bab5b3666b609d7b5241f04fdbddfa2b61dcc59
SSDEEP 49152:L+xaF9hutujvOOzu9Gb06+kpYtGU48/MlfR648A9Em029WAdgnMS:T9hutsLy406+kpYtGKMlfRt39Cuyn
TLSH
T11BE5AE21B7B2C075C25652308A29FBBA51BCEE318B3199C763C47E6F7E309D1D23561A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

739992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wintrust

WinVerifyTrust

ws2_32

inet_addr

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType ExitProcess GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GlobalLock GlobalUnlock GlobalAlloc GetCPInfo FlushFileBuffers GetSystemTimeAsFileTime LCMapStringEx EncodePointer SleepConditionVariableSRW WakeAllConditionVariable QueryPerformanceCounter AreFileApisANSI SetFileInformationByHandle HeapReAlloc FindFirstFileExW GetCurrentDirectoryW GetLocaleInfoEx RaiseException GetStringTypeW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx ReadConsoleW GetFileInformationByHandleEx WriteFile SetFileTime SetFilePointerEx SetEndOfFile ReadFile FormatMessageA LocalFree IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GlobalFree CreateMutexW CopyFileW GetProcessHeap MoveFileW MoveFileExW DecodePointer Process32FirstW DeleteFileW Process32NextW CreateToolhelp32Snapshot OpenProcess CreateFileW SetStdHandle InitializeCriticalSectionEx GetTempPathW RemoveDirectoryW TerminateProcess DeviceIoControl FindNextFileW CreateDirectoryW LoadLibraryA GetModuleHandleA GetModuleHandleW GetVersionExA GetLocalTime LoadLibraryW GetProcAddress FreeLibrary GetVersionExW lstrlenA GetTickCount MulDiv FindResourceW SizeofResource LockResource LoadResource FreeResource SetFileAttributesW EnumSystemLocalesW GetFileAttributesExW GetConsoleMode SetLastError GetFullPathNameW FindFirstFileW FindClose FlushInstructionCache GetCurrentProcess DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection HeapFree HeapAlloc HeapDestroy HeapCreate MultiByteToWideChar GetLastError SetCurrentDirectoryW GetModuleFileNameW WideCharToMultiByte CreateProcessW GetCurrentProcessId CloseHandle GetDiskFreeSpaceExW OutputDebugStringW Sleep GetConsoleOutputCP GetFileSizeEx GetCurrentThreadId GetTimeZoneInformation WaitForSingleObject OutputDebugStringA SetEnvironmentVariableW HeapSize WriteConsoleW

user32

UnregisterClassW RegisterClassExW CallWindowProcW DefWindowProcW GetActiveWindow PostMessageW DestroyWindow GetPropW SendMessageW ShowWindow EnumWindows CharUpperBuffW FillRect InvertRect TranslateMessage CreateWindowExW wsprintfW GetForegroundWindow MsgWaitForMultipleObjects SetMenuContextHelpId SetForegroundWindow GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu CreatePopupMenu IsMenu UpdateLayeredWindow MapVirtualKeyA CharLowerBuffW SystemParametersInfoA DrawTextW IsWindowVisible GetSystemMetrics GetSysColor EnableMenuItem ClientToScreen PeekMessageW DispatchMessageW DrawIconEx GetMessageW LoadImageW CreateIconFromResource LoadBitmapW GetClassNameW ScreenToClient SetCaretPos HideCaret GetCaretBlinkTime CreateCaret GetCursorPos SetWindowTextW InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow ReleaseCapture SetCapture GetCapture IsZoomed IsIconic SetLayeredWindowAttributes AnimateWindow TrackMouseEvent GetIconInfo DestroyIcon CharNextW GetDesktopWindow SetActiveWindow IsWindowEnabled EnableWindow PostQuitMessage EqualRect UnionRect SetRect KillTimer SetTimer SetCursor GetKeyState GetFocus SetFocus IsWindow DestroyCursor PtInRect IsRectEmpty OffsetRect IntersectRect InflateRect CopyRect GetMonitorInfoW MonitorFromWindow LoadCursorW GetWindow GetParent SetWindowLongW GetWindowLongW MapWindowPoints GetWindowRect GetClientRect GetDlgItem SetWindowPos

gdi32

CreateRectRgnIndirect CreateRectRgn CreatePatternBrush Ellipse CreateEllipticRgnIndirect CombineRgn Arc GetViewportOrgEx GetCurrentObject Polyline ExtCreatePen CreateDIBSection ExcludeClipRect GetClipRgn GetRgnBox GetTextColor GetTextExtentPoint32W IntersectClipRect OffsetRgn Pie PtInRegion RectInRegion RestoreDC RoundRect SaveDC ExtSelectClipRgn SetRectRgn SetROP2 SetTextColor GetWorldTransform CreatePen SetViewportOrgEx CreateCompatibleBitmap StretchBlt GetObjectW SetBkMode Rectangle GetStockObject GetClipBox CreateSolidBrush CreateFontIndirectW SetGraphicsMode GetDeviceCaps SelectObject DeleteDC CreateCompatibleDC CreateBitmap CreateRoundRectRgn EnumFontsW BitBlt DeleteObject SetWorldTransform

advapi32

CryptDeriveKey RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW RegCloseKey RegOpenKeyExA CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptEncrypt CryptAcquireContextW CryptGetKeyParam CryptDestroyKey RegQueryValueExW

shell32

ShellExecuteW SHGetSpecialFolderPathW SHGetPathFromIDListW SHGetSpecialFolderLocation SHBrowseForFolderW

ole32

CoInitialize CoCreateInstance CreateStreamOnHGlobal CLSIDFromProgID CLSIDFromString OleLockRunning CoCreateGuid OleInitialize OleUninitialize CoUninitialize CoTaskMemFree CreateBindCtx

oleaut32

SysFreeString SysStringLen SysAllocString SysAllocStringLen

shlwapi

PathRemoveFileSpecW StrCmpW PathIsDirectoryW StrToIntExW PathFileExistsW PathCanonicalizeW PathFindFileNameW PathRemoveExtensionW

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

netapi32

NetWkstaGetInfo NetApiBufferFree

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl

gdiplus

GdipDrawImageRectI GdipGraphicsClear GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetPropertyItem GdipGetImageEncodersSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToFile GdipGetImageEncoders GdipCloneImage GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipGetPropertyItemSize GdipDisposeImage

msimg32

AlphaBlend GradientFill

iphlpapi

GetIpForwardTable GetAdaptersInfo

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

84bd622196a8440a291d9f4ec542133a3449efcedf8f9b092ef59025cd250d48

wintrust

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

imm32

netapi32

version

winhttp

gdiplus

msimg32

iphlpapi

generic