7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401

Sharing

Copy URL Twitter E-mail

General

Target
7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401
Size 1.6MB
Sample260826-pd5ypaydpf
SHA256 7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401
MD5 384f7cb8e54f062b24cfb75e301f7c3d
SHA1 015ffd3e68e0eaea4d38c963142e029bd329aeef
SHA512 155497f89e4273f84f46515cb1aa28915e521a8ddd35c1e41a788b348e2a4ba7857f78c051502458222e685fa1512a3e50a40cb82af0ae8d3867c35a56b2cc98
SSDEEP 24576:lOwgFjCh0u1OetEIYXjttIdQ7GrpYazZQB18yZ1IWGhRVBb47WIDW:lOZFjCh0ux5ejw08EIWGxBbQPDW
TLSH
T121758D113609C036D96D12F159BCEFAA815CADB44F7408DBB7D42F6E5A308E36E31A27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401

File Explorer

7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401

.dll 1.6MB

7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401

IMPHASH 4659d4a83f7a0a973c08a300ad785ae0
SHA256 7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401
MD5 384f7cb8e54f062b24cfb75e301f7c3d
SHA1 015ffd3e68e0eaea4d38c963142e029bd329aeef
SHA512 155497f89e4273f84f46515cb1aa28915e521a8ddd35c1e41a788b348e2a4ba7857f78c051502458222e685fa1512a3e50a40cb82af0ae8d3867c35a56b2cc98
SSDEEP 24576:lOwgFjCh0u1OetEIYXjttIdQ7GrpYazZQB18yZ1IWGhRVBb47WIDW:lOZFjCh0ux5ejw08EIWGxBbQPDW
TLSH
T121758D113609C036D96D12F159BCEFAA815CADB44F7408DBB7D42F6E5A308E36E31A27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

664301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

QueryPerformanceFrequency GetThreadIOPendingFlag ResetEvent GlobalMemoryStatusEx QueryPerformanceCounter GetLogicalDrives CancelIo CreateWaitableTimerW GetQueuedCompletionStatus DuplicateHandle PostQueuedCompletionStatus ReadDirectoryChangesW CreateIoCompletionPort GetSystemTimes K32GetModuleFileNameExW K32GetProcessMemoryInfo GetPriorityClass GetProcessTimes GetModuleFileNameW SetLastError GetCurrentThreadId GetTickCount64 QueryDosDeviceW VirtualFree VirtualAlloc GetFileTime LocalFree GetEnvironmentVariableW GetWindowsDirectoryW GetSystemWindowsDirectoryW SetThreadPriority SetThreadPriorityBoost GetSystemTimeAsFileTime Sleep CancelWaitableTimer ResumeThread SetWaitableTimer Process32FirstW Process32NextW CreateToolhelp32Snapshot GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW GetDriveTypeW GetLocalTime GetDiskFreeSpaceExW OpenProcess GetFileSizeEx GetVolumeInformationW GetFileAttributesW GetModuleHandleW GetProcAddress FindResourceExW LoadLibraryW DeleteFileW SetEvent CreateEventW WaitForSingleObject WaitForMultipleObjects GetCurrentProcess LoadLibraryExW FreeLibrary FindResourceW LoadResource LockResource SizeofResource lstrcmpA DeviceIoControl WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale ExitProcess GetTimeZoneInformation WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException CloseHandle HeapReAlloc GetLastError MultiByteToWideChar HeapSize GetSystemDirectoryW CreateFileW FindClose InitializeCriticalSectionEx GetConsoleMode GetConsoleOutputCP GetFileType ExitThread RtlUnwind CreateTimerQueue QueryDepthSList InterlockedFlushSList ReleaseSemaphore VirtualProtect FreeLibraryAndExitThread GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WaitForSingleObjectEx GetVersionExW UnregisterWaitEx RegisterWaitForSingleObject OutputDebugStringA GetModuleHandleExW GetModuleHandleExA GetModuleHandleA GetNativeSystemInfo SetFilePointerEx SetFilePointer SetEndOfFile GetStdHandle CreateThread InitializeCriticalSection LeaveCriticalSection GetFinalPathNameByHandleW FindNextFileW EnterCriticalSection HeapFree FindFirstFileW GetCurrentThread InterlockedCompareExchange InterlockedExchange lstrcmpiW MapViewOfFileEx GetCommandLineW UnmapViewOfFile CreateFileMappingW GetTempPathW FormatMessageW GetStringTypeW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryEnterCriticalSection InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW FlushFileBuffers ReadFile WriteFile IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent LoadLibraryExA ReleaseMutex CreateMutexW GetCurrentProcessId UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW CreateProcessW

user32

DispatchMessageW IsWindow MsgWaitForMultipleObjectsEx TranslateMessage PostQuitMessage GetDC GetClassNameW UnhookWinEvent GetWindowTextW MonitorFromWindow ReleaseDC RegisterWindowMessageW CharLowerW SetWindowLongW DestroyWindow PostMessageW CallWindowProcW DefWindowProcW SetWinEventHook IsWindowVisible GetWindowRect GetWindowThreadProcessId GetIconInfo DestroyIcon GetWindowLongW UnregisterClassW GetWindowPlacement PeekMessageW FindWindowW GetMessageW UnregisterPowerSettingNotification RegisterPowerSettingNotification GetForegroundWindow SystemParametersInfoW CreateWindowExW RegisterClassExW SetTimer LoadCursorW KillTimer wsprintfW WaitForInputIdle CharNextW WaitMessage CallMsgFilterW GetQueueStatus GetClassInfoExW SendMessageTimeoutW

gdi32

GetObjectW DeleteObject GetDeviceCaps

advapi32

RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW CloseServiceHandle OpenSCManagerW QueryServiceConfigW OpenServiceW RegGetValueW GetTokenInformation RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegQueryInfoKeyW RegSetValueExW

shell32

SHGetSpecialFolderPathW SHGetKnownFolderPath SHGetFolderPathW SHGetFileInfoW ord165 SHCreateDirectoryExW

ole32

CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoUninitialize StringFromGUID2 CoCreateInstance CoCreateGuid CoInitialize CoInitializeSecurity CoSetProxyBlanket CoInitializeEx

oleaut32

VariantInit SysAllocString SetErrorInfo GetErrorInfo VarUI4FromStr SysStringLen SysAllocStringLen SysFreeString VariantClear

shlwapi

StrTrimA StrCmpNIW PathIsRootW StrStrIA PathFileExistsW PathIsRelativeW StrStrIW PathRemoveFileSpecW StrCmpIW PathAppendW SHGetValueW wnsprintfW PathIsDirectoryW PathFindFileNameW PathCombineW ord487 PathMatchSpecW

gdiplus

GdipGetImageHeight GdiplusStartup GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipCloneImage GdipBitmapUnlockBits GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImagePixelFormat GdipGetImageWidth GdipCreateBitmapFromHICON GdipFree GdipBitmapLockBits GdipGetImageEncoders GdipGetImageEncodersSize

powrprof

PowerGetActiveScheme

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeGetTime timeEndPeriod

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

Sharing

General

Malware Config

Signatures

File Explorer

7bac57affabc1605c2348914ef756e2f555193dbebd798c9e285aa168e8f0401

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

gdiplus

powrprof

wininet

iphlpapi

winmm

version

urlmon

generic