1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2

Sharing

Copy URL Twitter E-mail

General

Target
1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2
Size 1.6MB
Sample260826-d2ldeayvaz
SHA256 1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2
MD5 31b71898b87bfbad195bcca443a61f45
SHA1 be5247d9fda4b96e78a3899be559f714c43c232c
SHA512 3df3567f9c59803265b215a378362d4d344b8abf23223d17871a24178ea38af2a472e1c96e4f2f65e532fc459cba2fb3bbee32394dc903720e30f2cb84fc9ec8
SSDEEP 24576:X4GnEWWjYIOIUiFTVMw2zn6LdYIgs9YoNJSAujzc4sCAPOGF/Q397n:XrEWoOIUic/zuyAGzc4sNPOGF4397n
TLSH
T19C758D113649C032D96D12F04A7CBFBA816CADB40B7448DBB7D42F6E5A305D3AE35A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2

File Explorer

1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2

.dll 1.6MB

1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2

IMPHASH 2884acb21b3fa38677ed9e9d45aa1189
SHA256 1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2
MD5 31b71898b87bfbad195bcca443a61f45
SHA1 be5247d9fda4b96e78a3899be559f714c43c232c
SHA512 3df3567f9c59803265b215a378362d4d344b8abf23223d17871a24178ea38af2a472e1c96e4f2f65e532fc459cba2fb3bbee32394dc903720e30f2cb84fc9ec8
SSDEEP 24576:X4GnEWWjYIOIUiFTVMw2zn6LdYIgs9YoNJSAujzc4sCAPOGF/Q397n:XrEWoOIUic/zuyAGzc4sNPOGF4397n
TLSH
T19C758D113649C032D96D12F04A7CBFBA816CADB40B7448DBB7D42F6E5A305D3AE35A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

652157

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency GetThreadIOPendingFlag ResetEvent GlobalMemoryStatusEx QueryPerformanceCounter GetLogicalDrives CancelIo CreateWaitableTimerW GetQueuedCompletionStatus DuplicateHandle PostQueuedCompletionStatus ReadDirectoryChangesW CreateIoCompletionPort GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 QueryDosDeviceW VirtualFree VirtualAlloc GetFileTime GetWindowsDirectoryW SetThreadPriority GetSystemTimeAsFileTime Sleep GetCommandLineW SetWaitableTimer Process32FirstW Process32NextW CreateToolhelp32Snapshot GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetDriveTypeW GetLocalTime GetDiskFreeSpaceExW OpenProcess K32GetProcessImageFileNameW GetFileSizeEx GetVolumeInformationW GetFileAttributesW GetModuleHandleW GetProcAddress FindResourceExW LoadLibraryW DeleteFileW SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetCurrentProcess LoadLibraryExW FreeLibrary FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte GetProcessHeap lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCurrentThread GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID DeleteCriticalSection FindFirstFileW HeapDestroy CancelWaitableTimer DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar HeapSize GetSystemDirectoryW CreateFileW FindClose InitializeCriticalSectionEx IsValidLocale ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread UnmapViewOfFile CreateFileMappingW GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA InitializeCriticalSection LeaveCriticalSection GetFinalPathNameByHandleW FindNextFileW EnterCriticalSection HeapFree GetNativeSystemInfo GetOEMCP ResumeThread GetTempPathW SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle CreateThread InterlockedCompareExchange InterlockedExchange lstrcmpiW FormatMessageW GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA ReleaseMutex CreateMutexW GetCurrentProcessId LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CreateProcessW MapViewOfFileEx

user32

PeekMessageW DispatchMessageW CharLowerW PostQuitMessage TranslateMessage GetDC MonitorFromWindow ReleaseDC RegisterWindowMessageW GetIconInfo DestroyIcon GetWindowLongW EnumChildWindows UnregisterClassW GetWindowPlacement SetWindowLongW DestroyWindow PostMessageW CallWindowProcW DefWindowProcW SetWinEventHook IsWindowVisible GetWindowRect GetWindowThreadProcessId FindWindowW IsWindow GetClassNameW UnhookWinEvent GetWindowTextW KillTimer GetClassInfoExW MsgWaitForMultipleObjectsEx LoadCursorW GetClientRect SetTimer SystemParametersInfoW CreateWindowExW wsprintfW WaitForInputIdle CharNextW WaitMessage CallMsgFilterW GetQueueStatus RegisterClassExW SendMessageTimeoutW

gdi32

DeleteObject GetObjectW GetDeviceCaps

advapi32

RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueW GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW

shell32

SHGetSpecialFolderPathW SHGetFileInfoW ord165 SHGetKnownFolderPath SHCreateDirectoryExW SHGetFolderPathW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance StringFromGUID2 CoCreateGuid CoInitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoTaskMemFree CoUninitialize

oleaut32

SysAllocStringLen VariantClear VariantInit VarUI4FromStr SysStringLen SetErrorInfo SysFreeString SysAllocString GetErrorInfo

shlwapi

StrCmpIW StrStrIA PathIsRelativeW PathIsRootW StrStrIW StrTrimA PathRemoveFileSpecW PathFileExistsW PathAppendW SHGetValueW wnsprintfW PathIsDirectoryW PathFindFileNameW PathMatchSpecW ord487 PathCombineW StrCmpNIW

gdiplus

GdipBitmapUnlockBits GdipCloneImage GdipGetImageEncoders GdipGetImageHeight GdiplusStartup GdipSaveImageToFile GdipAlloc GdipDisposeImage GdipGetImagePixelFormat GdipFree GdipBitmapLockBits GdipGetImageEncodersSize GdipCreateBitmapFromHICON GdipGetImageWidth GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

1594483f535deb69e4595dec95e2d8c3db0c9ab7873d08a3f2115ed2960d86e2

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

wininet

iphlpapi

winmm

version

urlmon

generic