e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585

Sharing

Copy URL Twitter E-mail

General

Target
e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585
Size 1.2MB
Sample260826-e9r2layxhx
SHA256 e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585
MD5 15775b8b3ae970753a5b48be70b6c1fd
SHA1 167b595d4c758c69f60d8cc551d90d62c6244950
SHA512 768d0489bae516064cdfdd8998823bac8b9323ea459d58814de2a284911bec8fb42ff06bcb132b1966be0b8198adddd8d70192f6433b7d03546df67c9ee57a18
SSDEEP 24576:2TfD2Rn6qKwwl+aHokYL/KXUYl/39EyZVeS15:YfD2RnSwc+DKEYl/qyZVeS5
TLSH
T1BB559D113A45C032D66C22F0492CBFBED16C6D745B7408CB76E46FAE5A305D3AE31A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585

File Explorer

e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585

.dll 1.2MB

e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585

IMPHASH 5d55556c15a129b94946dc27acb56c37
SHA256 e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585
MD5 15775b8b3ae970753a5b48be70b6c1fd
SHA1 167b595d4c758c69f60d8cc551d90d62c6244950
SHA512 768d0489bae516064cdfdd8998823bac8b9323ea459d58814de2a284911bec8fb42ff06bcb132b1966be0b8198adddd8d70192f6433b7d03546df67c9ee57a18
SSDEEP 24576:2TfD2Rn6qKwwl+aHokYL/KXUYl/39EyZVeS15:YfD2RnSwc+DKEYl/qyZVeS5
TLSH
T1BB559D113A45C032D66C22F0492CBFBED16C6D745B7408CB76E46FAE5A305D3AE31A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

549021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency GetThreadIOPendingFlag ResetEvent GlobalMemoryStatusEx QueryPerformanceCounter GetLogicalDrives CancelIo CreateWaitableTimerW GetQueuedCompletionStatus DuplicateHandle PostQueuedCompletionStatus ReadDirectoryChangesW CreateIoCompletionPort GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetPriorityClass GetProcessTimes GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 QueryDosDeviceW VirtualFree VirtualAlloc GetFileTime LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime HeapFree EnterCriticalSection FindNextFileW GetFinalPathNameByHandleW LeaveCriticalSection InitializeCriticalSection InitializeCriticalSectionEx FindClose CreateFileW GetSystemDirectoryW HeapSize MultiByteToWideChar GetLastError HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap WideCharToMultiByte SizeofResource lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID GetCurrentThread ExitProcess GetTimeZoneInformation GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore CancelWaitableTimer ResumeThread SetWaitableTimer Process32FirstW OpenProcess GetFileSizeEx GetFileAttributesW GetModuleHandleW GetProcAddress FindResourceExW LoadLibraryW DeleteFileW Process32NextW VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject GetModuleHandleExW GetModuleHandleA SetFilePointerEx SetEndOfFile SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetCurrentProcess LoadLibraryExW FreeLibrary FindResourceW LoadResource GetStdHandle CreateToolhelp32Snapshot GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetDriveTypeW GetLocalTime IsValidLocale GetDiskFreeSpaceExW CreateThread FindFirstFileW LockResource Sleep lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW FormatMessageW GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA ReleaseMutex CreateMutexW GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CreateProcessW GetTempPathW

user32

GetWindowPlacement IsWindow GetClassNameW UnregisterClassW RegisterWindowMessageW ReleaseDC GetDC PostQuitMessage TranslateMessage MsgWaitForMultipleObjectsEx GetWindowLongW UnhookWinEvent GetWindowTextW CharLowerW DispatchMessageW MonitorFromWindow SetWindowLongW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification DestroyWindow GetForegroundWindow SystemParametersInfoW CreateWindowExW RegisterClassExW SetTimer LoadCursorW KillTimer GetClassInfoExW SendMessageTimeoutW FindWindowW GetWindowThreadProcessId GetWindowRect IsWindowVisible SetWinEventHook DefWindowProcW CallWindowProcW PostMessageW wsprintfW WaitForInputIdle CharNextW PeekMessageW

gdi32

GetDeviceCaps

advapi32

RegSetValueExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW GetTokenInformation RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW QueryServiceConfigW OpenServiceW

shell32

SHCreateDirectoryExW SHGetKnownFolderPath SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoUninitialize StringFromGUID2 CoCreateGuid CoInitialize CoInitializeSecurity CoSetProxyBlanket CoTaskMemFree CoCreateInstance

oleaut32

SysStringLen VarUI4FromStr VariantInit SysAllocStringLen SysAllocString SysFreeString VariantClear

shlwapi

StrCmpIW StrStrIA StrTrimA StrCmpNIW StrStrIW PathIsRelativeW PathCombineW PathIsRootW PathIsDirectoryW wnsprintfW SHGetValueW PathAppendW PathFileExistsW PathRemoveFileSpecW PathFindFileNameW

gdiplus

GdiplusStartup

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeGetTime

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

e11bcb35aeabc4d020b0f2c425360d56fd9f53713e0f613368c35db06adfc585

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic