d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82

Sharing

Copy URL Twitter E-mail

General

Target
d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82
Size 4.8MB
Sample260828-seq3psbk9s
SHA256 d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82
MD5 fd8991c2116315818d4c5d15338d1610
SHA1 481a6e2998ccfc0e68a4b61e1e1041efb9e01ce4
SHA512 277075aec45afe9d0a59c3ce68972a4970a823102fd78ce06bf4dce740131a4dc5fbb6e478d7ecb9aa9bf76cf0834e5e12935bba229089f8edb582ede9510953
SSDEEP 98304:zaTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/uk+:zaTiZ7qfRmp3QZ6/+9Fu/v0AmWh+
TLSH
T19636BE127BC2C47BC6030236985B936D51B5EFB14B3686E378D4BB2E1E386C36E35985
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82

File Explorer

d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82

.dll 4.8MB

d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82

IMPHASH b83cdc2d1260b7d6104ddd7f9272ead4
SHA256 d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82
MD5 fd8991c2116315818d4c5d15338d1610
SHA1 481a6e2998ccfc0e68a4b61e1e1041efb9e01ce4
SHA512 277075aec45afe9d0a59c3ce68972a4970a823102fd78ce06bf4dce740131a4dc5fbb6e478d7ecb9aa9bf76cf0834e5e12935bba229089f8edb582ede9510953
SSDEEP 98304:zaTiZ7qe+aOKvp3QZ6/HbS9FugmTw3gvhiWaOuBuJ0Ato4z/uk+:zaTiZ7qfRmp3QZ6/+9Fu/v0AmWh+
TLSH
T19636BE127BC2C47BC6030236985B936D51B5EFB14B3686E378D4BB2E1E386C36E35985
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4919296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

g:\Acro_root_at\bravo\public\libraries\windows\release\dynamic\agm4crtstdll\AGM.pdb

kernel32

GlobalSize GetVersionExA GetSystemInfo GetTickCount GetModuleHandleA GetTimeFormatA LocalAlloc InterlockedExchange RaiseException Sleep InterlockedCompareExchange TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime GetWindowsDirectoryA GetCurrentDirectoryA GetFileSize ReadFile SetCurrentDirectoryA IsProcessorFeaturePresent GetProfileStringA GlobalFree GlobalAlloc GlobalUnlock GlobalLock GetSystemDefaultLCID GetLocaleInfoA GetACP CreateFileA GetFileTime CloseHandle GetLastError FindFirstFileA FindNextFileA FindClose GetUserDefaultLangID FreeLibrary GetModuleFileNameA GetProcAddress LoadLibraryA GetDateFormatW GetTimeFormatW GetThreadLocale GetDateFormatA

user32

CharNextA GetDesktopWindow GetActiveWindow SetActiveWindow OffsetRect GetMonitorInfoA MonitorFromWindow MonitorFromPoint ScrollWindowEx UnregisterClassA LoadIconA LoadCursorA RegisterClassA SetWindowPos CreateWindowExA DestroyWindow DefWindowProcA WindowFromDC GetWindowRect GetDC ReleaseDC GetClientRect GetSystemMetrics

gdi32

ResetDCA CreateDCA ExtEscape StartPage StartDocA AbortDoc EndPage EndDoc SetMiterLimit ExtCreatePen GetCurrentObject Escape PolyDraw SelectClipPath IntersectClipRect GetClipBox Rectangle FillPath BeginPath EndPath SetGraphicsMode GetGraphicsMode GetWorldTransform ModifyWorldTransform StrokePath SetWorldTransform MoveToEx PolyBezierTo CloseFigure PolylineTo LineTo GetStockObject SetPolyFillMode StretchBlt CreatePalette CreateBrushIndirect PatBlt SelectPalette RealizePalette CreateDIBSection BitBlt GetDIBColorTable SelectClipRgn GetRegionData CreateRectRgn CombineRgn SaveDC ExtSelectClipRgn SetStretchBltMode StretchDIBits RestoreDC GetDeviceCaps CreateCompatibleBitmap GetObjectA DeleteObject DeleteDC SelectObject CreateCompatibleDC GetViewportOrgEx CreatePolyPolygonRgn

advapi32

RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantClear VariantInit

msvcp80

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_BADOFF@std@@3JB ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?to_int_type@?$char_traits@D@std@@SAHABD@Z ?to_char_type@?$char_traits@D@std@@SADABH@Z ?eq@?$char_traits@D@std@@SA_NABD0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z ?_Move_s@?$char_traits@D@std@@SAPADPADIPBDI@Z ?assign@?$char_traits@D@std@@SAXAADABD@Z ?_Xran@_String_base@std@@SAXXZ ?_Xlen@_String_base@std@@SAXXZ ?length@?$char_traits@D@std@@SAIPBD@Z ?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z ?_Move_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z ?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z ?length@?$char_traits@_W@std@@SAIPB_W@Z ?compare@?$char_traits@D@std@@SAHPBD0I@Z ?find@?$char_traits@D@std@@SAPBDPBDIABD@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?assign@?$char_traits@D@std@@SAPADPADID@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?good@ios_base@std@@QBE_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?width@ios_base@std@@QAEHH@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z ?eof@?$char_traits@D@std@@SAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBEHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z ?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?not_eof@?$char_traits@D@std@@SAHABH@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z

msvcr80

fseek _stricmp __clean_type_info_names_internal _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _CxxThrowException memset __CxxFrameHandler3 memcpy ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ _invalid_parameter_noinfo ??0exception@std@@QAE@ABV01@@Z __RTDynamicCast _purecall exit _control87 fclose malloc free qsort _CIsin _CIcos _CIpow _CIlog strstr _CIsqrt memmove_s wcstombs sscanf ferror fgetc fopen toupper memmove strncpy vsprintf rand ceil floor _CIfmod _CIlog10 _CIatan2 _hypot fread fwrite modf atoi strchr strncmp rename remove setbuf ftell fputs fflush feof isdigit freopen ungetc getc _ltoa strtok _strupr fprintf __iob_func calloc _CIatan realloc _unlock _encode_pointer __dllonexit _lock _onexit _decode_pointer ?terminate@@YAXXZ _except_handler4_common _malloc_crt

shlwapi

PathAppendA PathRemoveFileSpecA

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

131KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

281KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

d3f0b27a8ce5edeea863f3c530d3c833e50cd6184cdcc0c4431b9bbc6f7f8d82

kernel32

user32

gdi32

advapi32

ole32

oleaut32

msvcp80

msvcr80

shlwapi

generic