428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be

Sharing

Copy URL Twitter E-mail

General

Target
428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be
Size 1.6MB
Sample260826-pd59fsydpg
SHA256 428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be
MD5 67e3adf6266c3fabb166fab15f0c9304
SHA1 f1666412fe17364f4c032d0904160cd9d1d3fae7
SHA512 5f1efe14fda5b531ce42d41592ce40abba8ccb8e275310b162e0afd3a4fc157868923b74baa89ccde96d079c68a1bdb6c82569bffcff3a1af7aac64a2eea054a
SSDEEP 24576:oNF9UsvmUp90dRFlO4zfApoOgJvO3a7myXYEW3RFgTWiMScim:oj9nvmUp90zDz9BmNEW3bgyifcim
TLSH
T1E6759D113609C036D96D12F159BCEFAA815CEDB44F7408DBB7D42B6E5A308E36E31A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be

File Explorer

428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be

.dll 1.6MB

428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be

IMPHASH 4659d4a83f7a0a973c08a300ad785ae0
SHA256 428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be
MD5 67e3adf6266c3fabb166fab15f0c9304
SHA1 f1666412fe17364f4c032d0904160cd9d1d3fae7
SHA512 5f1efe14fda5b531ce42d41592ce40abba8ccb8e275310b162e0afd3a4fc157868923b74baa89ccde96d079c68a1bdb6c82569bffcff3a1af7aac64a2eea054a
SSDEEP 24576:oNF9UsvmUp90dRFlO4zfApoOgJvO3a7myXYEW3RFgTWiMScim:oj9nvmUp90zDz9BmNEW3bgyifcim
TLSH
T1E6759D113609C036D96D12F159BCEFAA815CEDB44F7408DBB7D42B6E5A308E36E31A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

664077

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency GetThreadIOPendingFlag ResetEvent GlobalMemoryStatusEx QueryPerformanceCounter GetLogicalDrives CancelIo CreateWaitableTimerW GetQueuedCompletionStatus DuplicateHandle PostQueuedCompletionStatus ReadDirectoryChangesW CreateIoCompletionPort GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetPriorityClass GetProcessTimes GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 QueryDosDeviceW VirtualFree VirtualAlloc GetFileTime LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime Sleep CancelWaitableTimer ResumeThread SetWaitableTimer Process32FirstW Process32NextW CreateToolhelp32Snapshot GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetDriveTypeW GetLocalTime GetDiskFreeSpaceExW OpenProcess GetFileSizeEx GetVolumeInformationW GetFileAttributesW GetModuleHandleW GetProcAddress FindResourceExW LoadLibraryW DeleteFileW SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetCurrentProcess LoadLibraryExW FreeLibrary FindResourceW LoadResource LockResource SizeofResource lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar HeapSize GetSystemDirectoryW CreateFileW FindClose InitializeCriticalSectionEx GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle CreateThread InitializeCriticalSection LeaveCriticalSection GetFinalPathNameByHandleW FindNextFileW EnterCriticalSection HeapFree FindFirstFileW GetCurrentThread InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW FormatMessageW GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA ReleaseMutex CreateMutexW GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CreateProcessW

user32

DispatchMessageW IsWindow MsgWaitForMultipleObjectsEx TranslateMessage PostQuitMessage GetDC GetClassNameW UnhookWinEvent GetWindowTextW MonitorFromWindow ReleaseDC RegisterWindowMessageW CharLowerW SetWindowLongW DestroyWindow PostMessageW CallWindowProcW DefWindowProcW SetWinEventHook IsWindowVisible GetWindowRect GetWindowThreadProcessId GetIconInfo DestroyIcon GetWindowLongW UnregisterClassW GetWindowPlacement PeekMessageW FindWindowW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW CreateWindowExW RegisterClassExW SetTimer LoadCursorW KillTimer wsprintfW WaitForInputIdle CharNextW WaitMessage CallMsgFilterW GetQueueStatus GetClassInfoExW SendMessageTimeoutW

gdi32

GetObjectW DeleteObject GetDeviceCaps

advapi32

RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW QueryServiceConfigW OpenServiceW RegGetValueW GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW

shell32

SHGetSpecialFolderPathW SHGetKnownFolderPath SHGetFolderPathW SHGetFileInfoW ord165 SHCreateDirectoryExW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoUninitialize StringFromGUID2 CoCreateInstance CoCreateGuid CoInitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx

oleaut32

VariantInit SysAllocString SetErrorInfo GetErrorInfo VarUI4FromStr SysStringLen SysAllocStringLen SysFreeString VariantClear

shlwapi

StrTrimA StrCmpNIW PathIsRootW StrStrIA PathFileExistsW PathIsRelativeW StrStrIW PathRemoveFileSpecW StrCmpIW PathAppendW SHGetValueW wnsprintfW PathIsDirectoryW PathFindFileNameW PathCombineW ord487 PathMatchSpecW

gdiplus

GdipGetImageHeight GdiplusStartup GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImagePixelFormat GdipGetImageWidth GdipCreateBitmapFromHICON GdipFree GdipBitmapLockBits GdipGetImageEncoders GdipGetImageEncodersSize

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

428bfc9d9d5f7c686cff63e08f005d466be416d40e959c6898069a5473f204be

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic