6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

Sharing

Copy URL Twitter E-mail

General

Target
6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
Size 1.1MB
Sample260826-wt6cqa1vbz
SHA256 6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
MD5 2376434a9ca07f26004d2483a5188a0f
SHA1 92ba454138b824875be9f54c1cd65cab8adf05e0
SHA512 375c9e0539d6e6805ea71f93bca6119efa281e899c256c3d68cf79ce1501489d5861a065a8e8fab81daaa0d067f78511a3580fecfcb9ed6917190534d1f4ec67
SSDEEP 24576:8bRbJaK2B91yhM3tqFdz7FPlUJmHdel/ck7:CwK2Bcz7FPlUJmZk
TLSH
T1E2358C1BABE521F5E477C178CD6A4406E7B378650771C7CF12A546AB0F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

File Explorer

6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

.exe 1.1MB

6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

IMPHASH 284a983483251e70f3e720181ff16c8a
SHA256 6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda
MD5 2376434a9ca07f26004d2483a5188a0f
SHA1 92ba454138b824875be9f54c1cd65cab8adf05e0
SHA512 375c9e0539d6e6805ea71f93bca6119efa281e899c256c3d68cf79ce1501489d5861a065a8e8fab81daaa0d067f78511a3580fecfcb9ed6917190534d1f4ec67
SSDEEP 24576:8bRbJaK2B91yhM3tqFdz7FPlUJmHdel/ck7:CwK2Bcz7FPlUJmZk
TLSH
T1E2358C1BABE521F5E477C178CD6A4406E7B378650771C7CF12A546AB0F232E09E3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

516896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\o_installer\Build\x64\UnicodeRelease\SamanUninstaller\SamanUninstaller.pdb

kernel32

GetUserDefaultUILanguage WaitForMultipleObjects WaitForSingleObject CreateEventW GetExitCodeProcess LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers SetFilePointerEx ReadConsoleW GetConsoleMode HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc VerifyVersionInfoW GetFileType SetStdHandle GetTimeZoneInformation GetCommandLineW GetCommandLineA FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW LCMapStringEx EncodePointer LeaveCriticalSection EnterCriticalSection VerSetConditionMask Process32FirstW Process32NextW CreateToolhelp32Snapshot SetFileAttributesW GetVersionExW FindClose GetEnvironmentVariableW K32GetModuleFileNameExW GetFinalPathNameByHandleW TerminateProcess GetStdHandle GetCurrentProcess FindNextFileW FindFirstFileW GetProcessHeap HeapAlloc GetCurrentThreadId HeapFree lstrcmpiW lstrcpyW lstrcpynW GetLocalTime GetLastError GlobalAlloc LockResource SizeofResource FreeResource LoadResource FindResourceW SystemTimeToFileTime LocalFileTimeToFileTime GetFileAttributesW SetFilePointer WriteFile LocalFree FormatMessageW InitializeCriticalSectionAndSpinCount ExitProcess GetACP GlobalUnlock GlobalLock CloseHandle ReadFile GetFileSize CreateFileW lstrlenW GetTickCount WideCharToMultiByte GetCurrentDirectoryW GetModuleFileNameW OpenProcess MulDiv GetProcAddress LoadLibraryW LoadLibraryExW MultiByteToWideChar MoveFileW CopyFileW DeleteCriticalSection SetCurrentDirectoryW DecodePointer Sleep InitializeCriticalSectionEx RemoveDirectoryW GetModuleHandleW GetCurrentProcessId MoveFileExW DeleteFileW GetModuleHandleExW RtlUnwind

user32

MapVirtualKeyExW GetKeyboardLayout GetKeyNameTextW SetFocus SetWindowTextW GetWindowRect MonitorFromWindow GetDC ReleaseDC RegisterWindowMessageW SendMessageW ScreenToClient PostQuitMessage MessageBoxW EnableMenuItem AppendMenuW CreatePopupMenu GetCaretBlinkTime SetForegroundWindow TrackPopupMenu DestroyMenu IsWindowEnabled UpdateWindow EqualRect GetWindowTextLengthW GetWindowTextW InvalidateRgn CreateAcceleratorTableW GetGUIThreadInfo DrawTextA ClientToScreen SetCaretPos GetCaretPos HideCaret ShowCaret CreateCaret CharPrevW SetRect DrawTextW FillRect GetWindowRgn UpdateLayeredWindow GetMenu AdjustWindowRectEx GetPropW SetPropW CallWindowProcW GetWindowLongPtrW RegisterClassExW GetClassInfoExW RegisterClassW EnableWindow ShowWindow SetWindowLongPtrW DefWindowProcW SetWindowRgn MoveWindow LoadCursorW SetCursor InflateRect LoadImageW GetParent PostMessageW SetCapture KillTimer SetTimer GetFocus IsZoomed DispatchMessageW TranslateMessage GetMessageW InvalidateRect GetSysColor ReleaseCapture PtInRect GetCursorPos CreateWindowExW OffsetRect GetMonitorInfoW MapWindowPoints IntersectRect IsWindowVisible IsWindow UnionRect IsRectEmpty GetUpdateRect EndPaint BeginPaint GetWindow GetActiveWindow IsIconic SetWindowLongW GetWindowLongW SetWindowPos GetClientRect DestroyWindow CharNextW GetKeyState

gdi32

CombineRgn ExtSelectClipRgn CreateRectRgnIndirect GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection CreateRoundRectRgn PlayEnhMetaFile CreateCompatibleBitmap GetEnhMetaFileHeader CreateDIBitmap AddFontMemResourceEx GetTextMetricsW StretchBlt CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SelectObject CreateCompatibleDC DeleteDC DeleteObject CreatePen CreateFontIndirectW GetStockObject GetObjectW GetDeviceCaps GetCurrentObject SetStretchBltMode CreateSolidBrush CreatePenIndirect MoveToEx LineTo GetObjectA SetBkMode SetTextColor SetBkColor GetCharABCWidthsW GetTextExtentPoint32W TextOutW GdiFlush EnumFontFamiliesExW CreatePatternBrush GetTextExtentPointA GetBitmapBits CloseEnhMetaFile RemoveFontMemResourceEx SetBitmapBits

advapi32

FreeSid RegEnumValueW RegDeleteValueW RegOpenKeyExW AllocateAndInitializeSid RegSetValueExW RegQueryValueExW CheckTokenMembership RegCloseKey RegDeleteKeyExW RegQueryInfoKeyW RegDeleteTreeW

shell32

SHGetSpecialFolderLocation SHCreateDirectoryExW DragQueryFileW SHChangeNotify ShellExecuteW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoTaskMemFree CLSIDFromProgID CLSIDFromString OleLockRunning CreateStreamOnHGlobal ReleaseStgMedium RegisterDragDrop DoDragDrop CoCreateInstance OleDuplicateData CoUninitialize CoInitialize StringFromGUID2

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

PathFindFileNameW StrStrIW SHDeleteKeyW PathFindExtensionW SHDeleteValueW PathIsDirectoryW SHGetValueW PathFileExistsW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

708KB

Virtual Size

708KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6b1d30b4b5859f65dd1e78bb02a1ed91391d77bfa4ace1da2179742306ccffda

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

shlwapi

generic