ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465

Sharing

Copy URL Twitter E-mail

General

Target
ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465
Size 1.6MB
Sample260826-d2ln6syvbw
SHA256 ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465
MD5 56c0fe90512d21c145e9d0de44a27381
SHA1 abea4b2130f6b69a3e4743db15f8d460e6f43de4
SHA512 6c907d05dd62675750673c36599780758148ccabb2111a9e66e164e242967def5fd5fc63597a7896a647630970fc0807235aff0f5d2d77e1b5acd95d38a7d41d
SSDEEP 49152:nX1olUrktNMFeqanXYc64PxcVnQZdVSU:nlooY564PBZ
TLSH
T140858D113A05C132E56C12F15AADEFBE905DAD740F7409CBB3D06B6E99309D36E32A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465

File Explorer

ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465

.dll 1.6MB

ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465

IMPHASH fc8ce2c0973cee8bef95c36fc1185a61
SHA256 ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465
MD5 56c0fe90512d21c145e9d0de44a27381
SHA1 abea4b2130f6b69a3e4743db15f8d460e6f43de4
SHA512 6c907d05dd62675750673c36599780758148ccabb2111a9e66e164e242967def5fd5fc63597a7896a647630970fc0807235aff0f5d2d77e1b5acd95d38a7d41d
SSDEEP 49152:nX1olUrktNMFeqanXYc64PxcVnQZdVSU:nlooY564PBZ
TLSH
T140858D113A05C132E56C12F15AADEFBE905DAD740F7409CBB3D06B6E99309D36E32A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

703181

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency GetThreadIOPendingFlag ResetEvent GlobalMemoryStatusEx QueryPerformanceCounter GetLogicalDrives CancelIo CreateWaitableTimerW GetQueuedCompletionStatus DuplicateHandle PostQueuedCompletionStatus ReadDirectoryChangesW CreateIoCompletionPort GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetPriorityClass GetProcessTimes GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 QueryDosDeviceW VirtualFree VirtualAlloc GetFileTime LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime Sleep CancelWaitableTimer ResumeThread SetWaitableTimer Process32FirstW Process32NextW CreateToolhelp32Snapshot GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetDriveTypeW GetLocalTime GetDiskFreeSpaceExW OpenProcess K32GetProcessImageFileNameW GetFileSizeEx GetVolumeInformationW GetFileAttributesW GetModuleHandleW GetProcAddress FindResourceExW LoadLibraryW DeleteFileW SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetCurrentProcess LoadLibraryExW FreeLibrary FindResourceW LoadResource LockResource SizeofResource lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar HeapSize GetSystemDirectoryW CreateFileW FindClose InitializeCriticalSectionEx GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle CreateThread InitializeCriticalSection LeaveCriticalSection GetFinalPathNameByHandleW FindNextFileW EnterCriticalSection HeapFree FindFirstFileW GetCurrentThread InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW FormatMessageW GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA ReleaseMutex CreateMutexW GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CreateProcessW

user32

DispatchMessageW IsWindow MsgWaitForMultipleObjectsEx TranslateMessage PostQuitMessage GetDC GetClassNameW UnhookWinEvent GetWindowTextW MonitorFromWindow ReleaseDC RegisterWindowMessageW CharLowerW SetWindowLongW DestroyWindow PostMessageW CallWindowProcW DefWindowProcW SetWinEventHook IsWindowVisible GetWindowRect GetWindowThreadProcessId GetIconInfo DestroyIcon GetWindowLongW UnregisterClassW GetWindowPlacement PeekMessageW FindWindowW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW CreateWindowExW RegisterClassExW SetTimer LoadCursorW KillTimer wsprintfW WaitForInputIdle CharNextW WaitMessage CallMsgFilterW GetQueueStatus GetClassInfoExW SendMessageTimeoutW

gdi32

GetObjectW DeleteObject GetDeviceCaps

advapi32

RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW QueryServiceConfigW OpenServiceW RegGetValueW GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW

shell32

SHGetSpecialFolderPathW SHGetKnownFolderPath SHGetFolderPathW SHGetFileInfoW ord165 SHCreateDirectoryExW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoUninitialize StringFromGUID2 CoCreateInstance CoCreateGuid CoInitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx

oleaut32

VariantInit SysAllocString SetErrorInfo GetErrorInfo VarUI4FromStr SysStringLen SysAllocStringLen SysFreeString VariantClear

shlwapi

StrTrimA StrCmpNIW PathIsRootW StrStrIA PathFileExistsW PathIsRelativeW StrStrIW PathRemoveFileSpecW StrCmpIW PathAppendW SHGetValueW wnsprintfW PathIsDirectoryW PathFindFileNameW PathCombineW ord487 PathMatchSpecW

gdiplus

GdipGetImageHeight GdiplusStartup GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImagePixelFormat GdipGetImageWidth GdipCreateBitmapFromHICON GdipFree GdipBitmapLockBits GdipGetImageEncoders GdipGetImageEncodersSize

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

ea3d1cb983a2a5a80ffd653aa1b4946d6e547ee0daab7e06e3b703a779447465

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic