d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4

Sharing

Copy URL Twitter E-mail

General

Target
d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4
Size 1.1MB
Sample260831-mpxeksswdv
SHA256 d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4
MD5 60c3f8330145e4ea533e23ac8f1c7d4f
SHA1 23efa697912af2d405ada42e2e09454dad3ef42a
SHA512 1f33b16654192ea139fde81aad330038918321431bc0e75e373f33a28edc38b96dfda7891be400b4f15c43684c3086feeab5c78d401482992926e7cc4e807deb
SSDEEP 24576:D0tSeGrPRRMs2+g/vKJg/fSrrR6Z2AFXH6VIhPVaFWfPQ+/:Dm/L3mRYJaVIeQnQ+
TLSH
T1CA350183A59140F6C83712B554B2DB3EFEB45A41897C9E87C398E8657C22D353A3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4

File Explorer

d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4

.dll 1.1MB

d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4

IMPHASH 1ff0b78964e1ef5a185b957ab7be4bd9
SHA256 d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4
MD5 60c3f8330145e4ea533e23ac8f1c7d4f
SHA1 23efa697912af2d405ada42e2e09454dad3ef42a
SHA512 1f33b16654192ea139fde81aad330038918321431bc0e75e373f33a28edc38b96dfda7891be400b4f15c43684c3086feeab5c78d401482992926e7cc4e807deb
SSDEEP 24576:D0tSeGrPRRMs2+g/vKJg/fSrrR6Z2AFXH6VIhPVaFWfPQ+/:Dm/L3mRYJaVIeQnQ+
TLSH
T1CA350183A59140F6C83712B554B2DB3EFEB45A41897C9E87C398E8657C22D353A3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA WideCharToMultiByte GetUserDefaultLCID GetCurrentDirectoryA SetCurrentDirectoryA Sleep ReadFile GetFileSize GetTickCount SetFilePointer RtlMoveMemory WritePrivateProfileStringA GetLocalTime FreeLibrary GetProcAddress LoadLibraryA LCMapStringA GetPrivateProfileStringA CreateFileA WriteFile IsBadReadPtr HeapFree MultiByteToWideChar HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap VirtualAlloc GetCurrentProcess VirtualFree IsWow64Process lstrcpyA lstrcatA MulDiv LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateThread Process32Next GlobalMemoryStatusEx OpenProcess SetEndOfFile Process32First CreateToolhelp32Snapshot GetCommandLineA CreateNamedPipeA SetWaitableTimer CreateWaitableTimerA ResumeThread SetThreadContext WriteProcessMemory GetThreadContext TerminateProcess VirtualAllocEx WTSGetActiveConsoleSessionId CreateProcessA ExpandEnvironmentStringsA GetModuleFileNameA GetComputerNameA FindClose FindFirstFileA CloseHandle WaitForSingleObject GetStartupInfoA ProcessIdToSessionId MoveFileA GetCurrentProcessId

user32

GetCursorPos CreateWindowExA GetDC GetSysColor SetWindowsHookExA MsgWaitForMultipleObjects CallWindowProcA PeekMessageA GetMessageA GetForegroundWindow FindWindowA GetWindowTextA GetWindow GetClassNameA GetLastInputInfo GetWindowTextLengthA ExitWindowsEx DialogBoxIndirectParamA EndDialog CallNextHookEx GetKeyState MessageBoxA TranslateMessage DispatchMessageA UnregisterHotKey SetWindowLongA SetCapture SendMessageA ScreenToClient ReleaseCapture RegisterHotKey LoadBitmapA wsprintfA

shell32

DragAcceptFiles DragFinish DragQueryFileA SHGetFolderPathA SHCreateDirectoryExA SHGetSpecialFolderPathA

gdi32

CreateFontA DeleteObject GetDeviceCaps TranslateCharsetInfo

ws2_32

gethostbyname WSACleanup gethostname sendto recvfrom htonl inet_addr connect ntohs getpeername send recv select WSAIoctl setsockopt inet_ntoa WSAStartup getsockname __WSAFDIsSet listen closesocket bind htons socket accept

advapi32

CreateServiceA OpenSCManagerA CryptDecrypt CryptDestroyKey CryptSetKeyParam CryptReleaseContext CryptImportKey CryptAcquireContextW CreateProcessAsUserA SetTokenInformation DuplicateTokenEx OpenProcessToken OpenServiceA DeleteService GetTokenInformation AdjustTokenPrivileges RegEnumKeyA RegCloseKey RegOpenKeyExA RegQueryValueExA LookupPrivilegeValueA RegOpenKeyA RegSetValueExA RegCreateKeyExA CloseServiceHandle

ole32

CLSIDFromProgID CLSIDFromString OleRun CoUninitialize CoInitialize CoCreateInstance

oleaut32

SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim VariantInit VariantCopy SafeArrayDestroy VariantClear SysAllocString SafeArrayCreate RegisterTypeLi LHashValOfNameSys LoadTypeLi VariantChangeType VarR8FromBool VarR8FromCy SafeArrayGetElemsize SafeArrayUnaccessData

wininet

InternetCloseHandle InternetOpenA HttpOpenRequestA InternetReadFile HttpSendRequestA InternetSetOptionA InternetConnectA

shlwapi

PathIsDirectoryA PathFileExistsA

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpReceiveResponse

msvcrt

tolower toupper vsprintf calloc __dllonexit _onexit strncmp memmove realloc rand srand strncpy _CIfmod atoi __CxxFrameHandler malloc free strrchr strchr ??2@YAPAXI@Z ??3@YAXPAX@Z sprintf _ftol floor modf

comctl32

ord17 ImageList_EndDrag ImageList_DragShowNolock ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove

Name

.text

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

808KB

Virtual Size

806KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d2fac07851e68d77a13281de6dba56af8357f4cb520c95b4568fa020513da0c4

kernel32

user32

shell32

gdi32

ws2_32

advapi32

ole32

oleaut32

wininet

shlwapi

wtsapi32

userenv

winhttp

msvcrt

comctl32

generic