b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146

Sharing

Copy URL Twitter E-mail

General

Target
b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146
Size 4.8MB
Sample260826-yzs1pafb73
SHA256 b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146
MD5 293e19c8e7184b4ed1b9cb7f25fbb07c
SHA1 fb3cdb16573faf96bc116237fdaab63f43411acf
SHA512 cbee64816c1f947d6d06672bdca6680c175d079d5a350ed7bc75ab5b705812fa0d6e2764b29e5cf4d41b45af7345beb83dc2798b9b151665ee26f64ae58133cc
SSDEEP 98304:BTglYUMZU1VweqA0mxabKKhXCqk8KsftqSCg23fvJc1F37K:BTyMWDweqExabBhXCqysYW23fh03O
TLSH
T1963633D0DEA2A5C5E49701329E13C63E5093FC6A82F2861703D8F7577A371225C9E76B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

File Explorer

b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146

.exe 4.8MB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

152KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

.exe 4.5MB

b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146
MD5 293e19c8e7184b4ed1b9cb7f25fbb07c
SHA1 fb3cdb16573faf96bc116237fdaab63f43411acf
SHA512 cbee64816c1f947d6d06672bdca6680c175d079d5a350ed7bc75ab5b705812fa0d6e2764b29e5cf4d41b45af7345beb83dc2798b9b151665ee26f64ae58133cc
SSDEEP 98304:BTglYUMZU1VweqA0mxabKKhXCqk8KsftqSCg23fvJc1F37K:BTyMWDweqExabBhXCqysYW23fh03O
TLSH
T1963633D0DEA2A5C5E49701329E13C63E5093FC6A82F2861703D8F7577A371225C9E76B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

IMPHASH 9b2f6a441f9ff8df98ae6e9e6b5d4271
SHA256 7b7e036b5361a14d87ced8d88d3681a28a2ba76c39d95877d3c24cb89f2d174c
MD5 2175ee3856663bc147424d549a25b225
SHA1 cc9f82fd8369d1d55264e465efa7c1cb812a8eff
SHA512 f7d9c0ed666ac4f55e03d24f5e681fead3d0e97f51749cac109ee2a3e757744e2fc016ef9726920fe8dd52588bc505667aca9e16b0ff95a7777315ebe0495c7b
SSDEEP 98304:7L3s0F7Q5o4YRv7xCfrouYfyV36jZ7nctkL2GMaT1f7uMKeHksxw5k+2lk6zSvLL:P80iTeCfYfI3617lhhfaoQL
TLSH
T1302633132270D072E1F32671DA79DAF595683B50427CE41FBB906F2D2E70250B9BE35A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\NetFXDev1\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb

advapi32

CreateWellKnownSid InitializeSecurityDescriptor SetEntriesInAclW SetSecurityDescriptorDacl SetSecurityDescriptorOwner CryptAcquireContextW CryptGenRandom CryptReleaseContext DecryptFileW

kernel32

GetTickCount SetEnvironmentVariableW GetLastError ExpandEnvironmentStringsW CreateProcessW Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventW GetEnvironmentVariableW DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW lstrlenW CompareStringW LocalFree CreateDirectoryW QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode RemoveDirectoryW MoveFileExW GetProcAddress GetSystemDirectoryW LoadLibraryW GetModuleHandleW CreateThread LocalAlloc RaiseException ExitThread WaitForMultipleObjects ResetEvent CreateEventA GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime GetModuleHandleA GetVersionExA SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW FreeLibrary InterlockedExchange RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW GetProcessHeap GlobalAlloc LoadLibraryA

comctl32

ord17

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageW PostMessageW DialogBoxParamW GetDlgItem SetWindowTextW EndDialog PostQuitMessage LoadStringW SetWindowLongW GetWindowLongW CharUpperW

oleaut32

SysAllocString VariantClear

b0ae1d29e20d66470847e59a4dc424b540442cfec4eb3fc2fd227d03711f1146

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$_20_/NDP471-KB4033342-x86-x64-AllOS-ENU.exe

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

oleaut32

generic