f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902

Sharing

Copy URL Twitter E-mail

General

Target
f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902
Size 14.3MB
Sample260831-fdextsvdla
SHA256 f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902
MD5 189cd114cd98a0373e08bd265ef45a16
SHA1 8239d25c6127377aedf108aba878c91caa6c9c7b
SHA512 b59b11ad60b20d51894038e57fc95906bfc06f1f9f65bd112952a42518dbece5ebb00cc192fe0b108ea6910b2590a90f31fc796338625956df0ed9fb93fd6c05
SSDEEP 98304:z8cAx9DKQJo5jPRMzAKkpdNcxZmRnvjJ3qr1PHaq5NVaIH:zjK9DKQJo59dKxZF
TLSH
T1F4E6E61AA77960D9C1BBC07892839F22BD2170D907396BF38590867A2F31EF86D3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902

File Explorer

f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902

.exe 14.3MB

f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902

IMPHASH 9cf634a92dd10af56c76131e7b0dfab6
SHA256 f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902
MD5 189cd114cd98a0373e08bd265ef45a16
SHA1 8239d25c6127377aedf108aba878c91caa6c9c7b
SHA512 b59b11ad60b20d51894038e57fc95906bfc06f1f9f65bd112952a42518dbece5ebb00cc192fe0b108ea6910b2590a90f31fc796338625956df0ed9fb93fd6c05
SSDEEP 98304:z8cAx9DKQJo5jPRMzAKkpdNcxZmRnvjJ3qr1PHaq5NVaIH:zjK9DKQJo59dKxZF
TLSH
T1F4E6E61AA77960D9C1BBC07892839F22BD2170D907396BF38590867A2F31EF86D3D754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11123052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nekowire.pdb

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlVirtualUnwind RtlGetVersion NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError RtlLookupFunctionEntry RtlCaptureContext NtQueryInformationProcess NtQuerySystemInformation

advapi32

RegOpenKeyExW RegCloseKey RegGetValueW RegQueryValueExW CopySid EventUnregister EventWriteTransfer OpenProcessToken IsValidSid GetLengthSid GetTokenInformation EventRegister EventSetInformation

kernel32

FormatMessageA GetSystemTime GetModuleFileNameW LoadLibraryExW GetSystemTimeAsFileTime WideCharToMultiByte HeapDestroy HeapCompact LoadLibraryW HeapReAlloc WaitForSingleObjectEx LoadLibraryA FlushViewOfFile OutputDebugStringW MultiByteToWideChar HeapSize MapViewOfFile GetProcessTimes GetSystemTimes GetUserDefaultUILanguage LCIDToLocaleName GetCurrentThreadId GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle IsProcessorFeaturePresent OpenProcess HeapAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive GetTickCount HeapFree WaitForSingleObject GetCurrentProcessId FormatMessageW IsDebuggerPresent GetProcessIoCounters FlushFileBuffers GetFileSize UnlockFile FreeLibrary DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetFileAttributesW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW AreFileApisANSI GetFileInformationByHandle GetConsoleMode WakeAllConditionVariable LoadLibraryExA HeapValidate UnmapViewOfFile OutputDebugStringA HeapCreate RaiseException VirtualQueryEx GetProcessHeap lstrlenW LocalFree SleepConditionVariableSRW GetModuleHandleW GetSystemInfo ReadProcessMemory GlobalMemoryStatusEx DeleteFileW SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter CreateFileW K32GetPerformanceInfo QueryPerformanceCounter CreateFileMappingW SystemTimeToFileTime LockFileEx CreateFileA CreateMutexW UnlockFileEx WriteFile ReadFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetEnvironmentVariableW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError SetFileInformationByHandle SetFileTime QueryPerformanceFrequency CreateThread ReadFileEx GetCurrentProcess DuplicateHandle GetSystemTimePreciseAsFileTime GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetStdHandle CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess SwitchToThread CreateMutexA ReleaseMutex GetFinalPathNameByHandleW SetEnvironmentVariableW WriteConsoleW GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer FindNextFileW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ole32

CoTaskMemAlloc CoCreateInstance CoInitializeEx RevokeDragDrop OleInitialize RegisterDragDrop CoTaskMemFree CoUninitialize CoCreateFreeThreadedMarshaler

user32

GetCursorPos SendMessageW SetCursorPos FlashWindowEx GetClientRect DefWindowProcW SetWindowPlacement GetWindowLongW GetWindowTextLengthW SystemParametersInfoA CreateIcon GetSystemMetrics AdjustWindowRectEx LoadCursorW SystemParametersInfoW IsIconic IsWindow SetCursor GetTouchInputInfo RegisterTouchWindow CloseTouchInputHandle UpdateWindow InvalidateRgn SetWindowDisplayAffinity ClientToScreen InvalidateRect ScreenToClient TrackMouseEvent GetForegroundWindow GetMonitorInfoW MonitorFromRect MsgWaitForMultipleObjectsEx MonitorFromWindow FillRect IsWindowVisible CreateWindowExW FindWindowExW GetWindowRect GetWindowLongPtrW RedrawWindow ValidateRect GetUpdateRect IsProcessDPIAware MapVirtualKeyW SetWindowLongPtrW GetWindowPlacement SetWindowTextW GetActiveWindow EnableWindow IsWindowEnabled SetWindowLongW SetWindowRgn GetWindowTextW GetDC ReleaseDC GetMessageA EnableMenuItem GetSystemMenu GetClipCursor ShowCursor ShowWindow RegisterWindowMessageA GetWindow SetParent SetFocus MapWindowPoints GetRawInputData SetCapture VkKeyScanW DrawIconEx DrawTextW GetKeyState ToUnicodeEx ReleaseCapture GetAsyncKeyState GetKeyboardState GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu CheckMenuItem GetMenuItemInfoW MapVirtualKeyExW GetKeyboardLayout SendInput RemoveMenu CreatePopupMenu CreateMenu SetMenu DrawMenuBar SetMenuItemInfoW InsertMenuW AppendMenuW TrackPopupMenu PostQuitMessage CreateAcceleratorTableW DestroyAcceleratorTable RegisterRawInputDevices ClipCursor ChangeDisplaySettingsExW SetForegroundWindow EnumDisplayMonitors MonitorFromPoint DestroyIcon SetPropW GetParent TranslateAcceleratorW PostThreadMessageW TranslateMessage RegisterClassExW EnumChildWindows DispatchMessageW DispatchMessageA AdjustWindowRect DestroyWindow SetWindowPos PostMessageW PeekMessageW GetMessageW GetMenu

comctl32

DefSubclassProc SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass

shlwapi

SHCreateMemStream

shell32

SHGetKnownFolderPath DragFinish DragQueryFileW SHAppBarMessage CommandLineToArgvW

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

gdi32

CreateSolidBrush GetDeviceCaps DeleteObject DeleteDC BitBlt CombineRgn CreateDIBSection SelectObject CreateRectRgn SetTextColor SetBkMode CreateCompatibleDC

pdh

PdhGetFormattedCounterValue PdhCloseQuery PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter PdhOpenQueryA

powrprof

CallNtPowerInformation

psapi

GetProcessMemoryInfo GetModuleFileNameExW

vcruntime140

memcpy __CxxFrameHandler3 memset memcmp memmove memchr strchr strrchr __C_specific_handler wcsrchr _purecall _CxxThrowException __std_exception_destroy __current_exception __current_exception_context __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strlen strspn wcslen wcscmp _wcsicmp strncmp strcspn strcmp

api-ms-win-crt-math-l1-1-0

_dclass floor pow roundf fabs round sin trunc log __setusermatherr

api-ms-win-crt-heap-l1-1-0

_callnewh free _msize malloc _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e _configure_narrow_argv _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _beginthreadex _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _endthreadex exit

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

f4a705b482e566ebd9ba487ae069eabe99826414e0f7de7e9c4c3be8016f9902

bcryptprimitives

ntdll

advapi32

kernel32

api-ms-win-core-synch-l1-2-0

ole32

user32

comctl32

shlwapi

shell32

oleaut32

dwmapi

gdi32

pdh

powrprof

psapi

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic