4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0

Sharing

Copy URL Twitter E-mail

General

Target
4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0
Size 1.6MB
Sample260826-e4w4csyxdw
SHA256 4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0
MD5 418e70bcb6aad4231ce716a163b563b2
SHA1 e17a004207bd2f17ca9326addc91b474983ce1e0
SHA512 437cd04ca9701f18732047c0ee91c6a20663f9df9dbcd6bad31a125356a172776f8d55586417d489da5167002691735f394c8e73a7dabf3ea93daf1f807c8459
SSDEEP 49152:Bo3fuWeGRvfnALdGypHnqfXh6T7eMSsc0:kZXHypHzT
TLSH
T115758D113609C032D96C12F05A3DAFAF816CADB44B7409DB77D42F6E99305D3AE35A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0

File Explorer

4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0

.dll 1.6MB

4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0

IMPHASH 6d5e0c7f9a2cb1d86e3606c504ee83da
SHA256 4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0
MD5 418e70bcb6aad4231ce716a163b563b2
SHA1 e17a004207bd2f17ca9326addc91b474983ce1e0
SHA512 437cd04ca9701f18732047c0ee91c6a20663f9df9dbcd6bad31a125356a172776f8d55586417d489da5167002691735f394c8e73a7dabf3ea93daf1f807c8459
SSDEEP 49152:Bo3fuWeGRvfnALdGypHnqfXh6T7eMSsc0:kZXHypHzT
TLSH
T115758D113609C032D96C12F05A3DAFAF816CADB44B7409DB77D42F6E99305D3AE35A2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

644029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency GetThreadIOPendingFlag ResetEvent GlobalMemoryStatusEx QueryPerformanceCounter GetLogicalDrives CancelIo CreateWaitableTimerW GetQueuedCompletionStatus DuplicateHandle PostQueuedCompletionStatus ReadDirectoryChangesW CreateIoCompletionPort GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetPriorityClass GetProcessTimes GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 QueryDosDeviceW VirtualFree VirtualAlloc GetFileTime LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime Sleep CancelWaitableTimer ResumeThread SetWaitableTimer Process32FirstW Process32NextW CreateToolhelp32Snapshot GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetDriveTypeW GetLocalTime OpenProcess GetFileSizeEx GetVolumeInformationW GetFileAttributesW GetModuleHandleW GetProcAddress FindResourceExW LoadLibraryW DeleteFileW SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetCurrentProcess LoadLibraryExW FreeLibrary FindResourceW LoadResource LockResource SizeofResource lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar HeapSize GetSystemDirectoryW CreateFileW FindClose InitializeCriticalSectionEx GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle CreateThread InitializeCriticalSection LeaveCriticalSection GetFinalPathNameByHandleW FindNextFileW EnterCriticalSection HeapFree FindFirstFileW GetCurrentThread InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW FormatMessageW GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA ReleaseMutex CreateMutexW GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CreateProcessW

user32

DispatchMessageW IsWindow MsgWaitForMultipleObjectsEx TranslateMessage PostQuitMessage GetDC GetClassNameW UnhookWinEvent GetWindowTextW MonitorFromWindow ReleaseDC RegisterWindowMessageW CharLowerW SetWindowLongW DestroyWindow PostMessageW CallWindowProcW DefWindowProcW SetWinEventHook IsWindowVisible GetWindowRect GetWindowThreadProcessId GetIconInfo DestroyIcon GetWindowLongW UnregisterClassW GetWindowPlacement PeekMessageW FindWindowW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW CreateWindowExW RegisterClassExW SetTimer LoadCursorW KillTimer wsprintfW WaitForInputIdle CharNextW WaitMessage CallMsgFilterW GetQueueStatus GetClassInfoExW SendMessageTimeoutW

gdi32

GetObjectW DeleteObject GetDeviceCaps

advapi32

RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW QueryServiceConfigW OpenServiceW RegGetValueW GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW

shell32

SHGetSpecialFolderPathW SHGetKnownFolderPath SHGetFolderPathW SHGetFileInfoW ord165 SHCreateDirectoryExW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoUninitialize StringFromGUID2 CoCreateInstance CoCreateGuid CoInitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx

oleaut32

VariantInit SysAllocString SetErrorInfo GetErrorInfo VarUI4FromStr SysStringLen SysAllocStringLen SysFreeString VariantClear

shlwapi

StrTrimA StrCmpNIW PathIsRootW StrStrIA PathFileExistsW PathIsRelativeW StrStrIW PathRemoveFileSpecW StrCmpIW PathAppendW SHGetValueW wnsprintfW PathIsDirectoryW PathFindFileNameW PathCombineW ord487 PathMatchSpecW

gdiplus

GdipGetImageHeight GdiplusStartup GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImagePixelFormat GdipGetImageWidth GdipCreateBitmapFromHICON GdipFree GdipBitmapLockBits GdipGetImageEncoders GdipGetImageEncodersSize

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

4fecf146db265d65309102b9c993d6ff5a1bf5437642b347b4607e974b3a5db0

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic