4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de

Sharing

Copy URL Twitter E-mail

General

Target
4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de
Size 17.1MB
Sample260831-fezcvsxtes
SHA256 4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de
MD5 6ee7ed6c4c152904ad988f83f4ec5366
SHA1 8a429aff0be16bee2e5c870475317b65ab3efa81
SHA512 76d3f6e81394ce97df9362bbb52944b72fca717d60e0cc0527dc50db19fbbc8c28faacf836762e27e1d93e24dc8f140f253e72d6f262e6ef08d3d361da129e7a
SSDEEP 393216:Jn3L4O5itEscwyXM9MtqU/8dmnT/U4Sj:Jn3LotEsHissHnk
TLSH
T1F30729E115D385D8C119C17981826B2FB57B77230332A79F72BCA5F29E12B853A67B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de

File Explorer

4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de

.exe 17.1MB

4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de

IMPHASH cc22c935cccd54b98d0d27ecd5b33334
SHA256 4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de
MD5 6ee7ed6c4c152904ad988f83f4ec5366
SHA1 8a429aff0be16bee2e5c870475317b65ab3efa81
SHA512 76d3f6e81394ce97df9362bbb52944b72fca717d60e0cc0527dc50db19fbbc8c28faacf836762e27e1d93e24dc8f140f253e72d6f262e6ef08d3d361da129e7a
SSDEEP 393216:Jn3L4O5itEscwyXM9MtqU/8dmnT/U4Sj:Jn3LotEsHissHnk
TLSH
T1F30729E115D385D8C119C17981826B2FB57B77230332A79F72BCA5F29E12B853A67B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14578748

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Documents\GitHub\web\loader\binary\Production\loader.pdb

ws2_32

WSASend select ntohl listen WSASetLastError getsockopt WSARecv WSAAddressToStringW connect ntohs getsockname getpeername getaddrinfo WSASocketW recv send WSAIoctl WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents socket gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname shutdown recvfrom sendto bind accept __WSAFDIsSet htonl htons freeaddrinfo WSACleanup closesocket WSAGetLastError setsockopt WSACloseEvent ioctlsocket WSAStartup

iphlpapi

GetAdaptersInfo

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitialize CoUninitialize CoCreateInstance

kernel32

TerminateProcess Module32Next Module32First OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetSystemTime EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection WaitForSingleObject PostQueuedCompletionStatus FormatMessageW SetEvent TerminateThread QueueUserAPC GetModuleFileNameA DeleteFileA CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx WriteProcessMemory VirtualAlloc ResumeThread GetThreadContext GetThreadId ReadProcessMemory GetModuleHandleW SetThreadContext GetCommandLineA ExitProcess ReadFile SetWaitableTimer SetLastError InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateEventW CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection OutputDebugStringW VirtualFree InitializeCriticalSection CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW OutputDebugStringA GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread Process32First GetExitCodeThread GetProcessId GetCurrentThreadId GetSystemInfo VirtualAllocEx VirtualFreeEx VirtualProtectEx CreateRemoteThread VirtualQueryEx LoadLibraryW SuspendThread GetThreadTimes OpenThread FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree DeleteCriticalSection FlsGetValue FlsAlloc SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx GetCPInfo LCMapStringEx EncodePointer GetStringTypeW RaiseException WaitForSingleObjectEx TryAcquireSRWLockExclusive GetCurrentProcessId GetConsoleMode Sleep GetDynamicTimeZoneInformation VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar WakeConditionVariable CreateSymbolicLinkW GetFileInformationByHandleEx CreateHardLinkW WriteFile WriteConsoleA CopyFileW GetConsoleOutputCP AreFileApisANSI FormatMessageA SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW LocalFree GetLocaleInfoEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo IsWow64Process CreateDirectoryA SleepConditionVariableSRW WakeAllConditionVariable FindNextFileW FindFirstFileW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation GetFileSizeEx SwitchToFiber CreateSemaphoreA GetACP VirtualProtect GetSystemDirectoryA GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock GetFileType WaitNamedPipeW DecodePointer GetFileAttributesA GetLastError GetTempPathA InitializeCriticalSectionEx GetCurrentProcess QueryPerformanceCounter FlsSetValue FreeLibrary TransactNamedPipe SetNamedPipeHandleState CreateSemaphoreW ReleaseSemaphore SetUnhandledExceptionFilter CreateEventA WriteConsoleW

user32

SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient MonitorFromWindow GetCursorPos CloseClipboard GetMessageExtraInfo GetKeyState MessageBoxW EnumDisplayDevicesW GetProcessWindowStation MessageBoxA GetWindowRect ShowWindow PostMessageA SetWindowPos PeekMessageA TranslateMessage MoveWindow DispatchMessageA GetDpiForSystem EmptyClipboard GetClipboardData OpenClipboard SetClipboardData LoadCursorA GetUserObjectInformationW UpdateWindow PostQuitMessage DefWindowProcA GetMonitorInfoA SetWindowLongA RegisterClassExW UnregisterClassW GetSystemMetrics CreateWindowExW DestroyWindow wsprintfW

gdi32

DeleteObject CreateRectRgn

advapi32

CloseServiceHandle CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource LookupPrivilegeValueW RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW RevertToSelf PrivilegeCheck SetTokenInformation SetThreadToken DuplicateTokenEx CreateProcessAsUserA ConvertSidToStringSidW GetUserNameW RegEnumValueA RegDeleteValueA RegEnumKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken GetTokenInformation QueryServiceStatus CryptAcquireContextA OpenSCManagerA OpenServiceA RegDeleteTreeA RegCloseKey RegDeleteKeyA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA

shell32

ShellExecuteW ShellExecuteA

oleaut32

SysFreeString

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

shlwapi

SHDeleteKeyW

urlmon

URLDownloadToFileA

dbghelp

SymGetTypeFromName SymCleanup SymLoadModuleEx SymGetTypeInfo SymUnloadModule64 SymFromName SymInitialize

ntdll

RtlPcToFileHeader RtlLookupFunctionEntry RtlCaptureContext RtlNtStatusToDosError RtlInitAnsiString RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlVirtualUnwind

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CertOpenSystemStoreW

wininet

HttpOpenRequestW HttpSendRequestW HttpQueryInfoW InternetSetOptionW InternetQueryDataAvailable InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW HttpAddRequestHeadersW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4e507eee5b6fb686e3d2f7c1e7693ae80aeef4d9b8408d8672f45016e03968de

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

shell32

oleaut32

imm32

dwmapi

shlwapi

urlmon

dbghelp

ntdll

crypt32

wininet

generic