100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6

Sharing

Copy URL Twitter E-mail

General

Target
100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6
Size 4.8MB
Sample260831-ngncdahn4w
SHA256 100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6
MD5 1b5608ab439a480f83e4ad0acbc67a0a
SHA1 097ff219367edbe7bf9b7562ef30d5aefc976cfd
SHA512 d388bdfa43c1ab3b13f4b59106e7011e21fa058b83515852a80813119241b8d50c2200212bf7f64ef3876074adff83681f79eb78550530656f63eddeb23a64e9
SSDEEP 98304:hnJWM06EuVPVCxyNhl1HB6VUbaU/JYA+2Nfm/6aaM:hnJmKNEsvHB6VUbX/qA+wf6
TLSH
T17F36CF11BA82C070D96F0330296D7BBE0D796E642B34C1D777B4295C8D705E27ABA3A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6

File Explorer

100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6

.dll 4.8MB

100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6

IMPHASH b86aa6a8e0704be9b9c4c76e818bcc36
SHA256 100e1438aeb6c6dcc814be2c54ffd1da6a6a7ff85db277f9ad9038de879c54f6
MD5 1b5608ab439a480f83e4ad0acbc67a0a
SHA1 097ff219367edbe7bf9b7562ef30d5aefc976cfd
SHA512 d388bdfa43c1ab3b13f4b59106e7011e21fa058b83515852a80813119241b8d50c2200212bf7f64ef3876074adff83681f79eb78550530656f63eddeb23a64e9
SSDEEP 98304:hnJWM06EuVPVCxyNhl1HB6VUbaU/JYA+2Nfm/6aaM:hnJmKNEsvHB6VUbX/qA+wf6
TLSH
T17F36CF11BA82C070D96F0330296D7BBE0D796E642B34C1D777B4295C8D705E27ABA3A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1673592

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

UnmapViewOfFile CreateFileMappingW MapViewOfFile SetCurrentDirectoryW WaitForMultipleObjects SleepEx FormatMessageA GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemInfo GetTickCount GetModuleHandleW GetCurrentThreadId VirtualAlloc lstrlenA GetFileSizeEx GetFileInformationByHandle InterlockedCompareExchange GetSystemTimeAsFileTime TlsFree TlsSetValue FindFirstFileW GetWindowsDirectoryW OpenProcess WideCharToMultiByte GetProcessHeap DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc RaiseException MulDiv MultiByteToWideChar HeapSize CreateProcessW LocalFree InitializeCriticalSectionAndSpinCount HeapFree DeleteFileA GetPrivateProfileStringW GetModuleFileNameW GetPrivateProfileIntW lstrlenW WritePrivateProfileStringW GetSystemDirectoryW GetVolumeInformationW ReleaseMutex CreateMutexW FreeLibrary GetProcAddress LoadLibraryW CloseHandle GetLastError GetVersionExW InterlockedDecrement CreateFileW DeviceIoControl OutputDebugStringA GetCurrentProcess SetPriorityClass InterlockedIncrement Process32FirstW Process32NextW CreateToolhelp32Snapshot LocalAlloc TerminateProcess GetDriveTypeW WTSGetActiveConsoleSessionId CreateFileA GetEnvironmentVariableW RemoveDirectoryW CreateDirectoryW GetCurrentProcessId GetFileSize MoveFileExW DeleteFileW FileTimeToSystemTime GetFileAttributesExW HeapReAlloc LoadLibraryExW GetTempPathW WriteFile ReadFile GlobalUnlock GlobalLock GlobalFree TlsGetValue TlsAlloc GlobalAlloc CreateThread TerminateThread SetEvent Sleep GetExitCodeThread CreateEventW FindFirstFileA SetEndOfFile SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA SetStdHandle GetCurrentDirectoryW GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetACP GetConsoleCP SetConsoleCtrlHandler ExitProcess SetFilePointerEx SystemTimeToTzSpecificLocalTime ExitThread WriteConsoleW GetModuleFileNameA RtlUnwind InterlockedFlushSList FreeLibraryAndExitThread GetThreadTimes GetVersionExA GetLocalTime GetFullPathNameW FindResourceW SizeofResource LoadResource LockResource FreeResource HeapCreate FlushInstructionCache OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ResetEvent SystemTimeToFileTime GetSystemTime ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiber ConvertFiberToThread CreateFiber DeleteFiber SetLastError SwitchToFiber GetModuleHandleExW VerifyVersionInfoA GetSystemDirectoryA GetModuleHandleA LoadLibraryA VerSetConditionMask ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection lstrcpyW FindClose GetLongPathNameW FindNextFileW WaitForSingleObjectEx GetCurrentThread QueryPerformanceCounter EncodePointer IsProcessorFeaturePresent GetFileType

user32

wsprintfW UnregisterClassW ReleaseDC MonitorFromRect GetDC GetWindowRect ShowWindow SetTimer DestroyWindow IntersectRect OffsetRect FindWindowW IsWindowEnabled EnableWindow SendMessageW PostMessageW IsWindow LoadStringW GetClassNameW TranslateMessage GetDesktopWindow SystemParametersInfoW GetWindowLongW GetKeyState OpenClipboard CloseClipboard EmptyClipboard SetClipboardData SetWindowPos SetWindowLongW SetForegroundWindow SetMenuContextHelpId GetMenuItemInfoW SetMenuInfo GetMenuInfo TrackPopupMenu AppendMenuW GetMenuItemCount DestroyMenu CreatePopupMenu IsMenu UpdateLayeredWindow MapVirtualKeyA CharLowerBuffW SystemParametersInfoA DrawTextW IsWindowVisible DispatchMessageW PeekMessageW IsIconic GetProcessWindowStation GetUserObjectInformationW MessageBoxW InflateRect DrawIconEx GetIconInfo LoadCursorW DestroyCursor DefWindowProcW CallWindowProcW RegisterClassExW CreateWindowExW GetDlgItem GetActiveWindow GetClientRect MapWindowPoints GetParent GetWindow MonitorFromWindow GetMonitorInfoW SetFocus GetFocus SetCursor CharNextW CopyRect IsRectEmpty PtInRect DestroyIcon KillTimer UnionRect EqualRect PostQuitMessage SetActiveWindow TrackMouseEvent AnimateWindow SetLayeredWindowAttributes GetSystemMetrics IsZoomed GetCapture SetCapture ReleaseCapture UpdateWindow BeginPaint EndPaint InvalidateRect SetWindowTextW GetCursorPos ScreenToClient LoadBitmapW CreateIconFromResource LoadImageW GetMessageW ClientToScreen SetRect EnableMenuItem GetSysColor SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx

gdi32

CreateCompatibleDC DeleteDC DeleteObject GetTextExtentPointI IntersectClipRect SelectClipRgn SelectObject AddFontMemResourceEx RemoveFontMemResourceEx SetTextAlign GetTextMetricsW ExtTextOutW GetTextFaceW ExtCreateRegion GetCurrentObject SetGraphicsMode SetWorldTransform CreateDIBSection GetObjectW SetViewportOrgEx EnumFontsW CreateBitmap CreateFontIndirectW CreatePen CreateSolidBrush GetStockObject Rectangle SetBkMode SetTextColor StretchBlt GetGlyphIndicesW GetViewportOrgEx BitBlt GetDeviceCaps EnumFontFamiliesExW GetCharABCWidthsW GetFontData GetGlyphOutlineW GetOutlineTextMetricsW GetFontUnicodeRanges GdiFlush

advapi32

SetTokenInformation RegDeleteKeyW RegDeleteValueW CreateProcessAsUserW SetSecurityDescriptorDacl OpenProcessToken InitializeSecurityDescriptor DuplicateTokenEx LookupAccountSidW GetTokenInformation RevertToSelf RegEnumKeyW ImpersonateLoggedOnUser RegOpenKeyW RegCloseKey RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptGenRandom RegFlushKey CloseServiceHandle CreateServiceW OpenSCManagerW OpenServiceW StartServiceW RegQueryValueExA DeleteService

shell32

SHGetFolderPathW ShellExecuteW SHGetSpecialFolderPathA SHChangeNotify SHGetSpecialFolderPathW SHGetSpecialFolderLocation SHGetPathFromIDListW

ole32

CLSIDFromProgID CLSIDFromString OleLockRunning CoInitialize CoUninitialize CoCreateGuid CoCreateInstance CreateStreamOnHGlobal OleUninitialize OleInitialize CoTaskMemFree CreateBindCtx

msimg32

AlphaBlend

shlwapi

SHDeleteValueW SHSetValueW PathFileExistsW PathAddBackslashW StrToIntExW SHGetValueW SHDeleteKeyW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wldap32

ord27 ord32 ord33 ord35 ord79 ord26 ord200 ord301 ord46 ord211 ord22 ord41 ord30 ord50 ord143 ord60

ws2_32

send closesocket connect getpeername recv getsockopt htons ntohs setsockopt socket WSAIoctl getaddrinfo freeaddrinfo recvfrom sendto accept listen ioctlsocket gethostname WSASetLastError select __WSAFDIsSet WSAGetLastError WSACleanup WSAStartup getsockname bind

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wtsapi32

WTSQueryUserToken

wke_x86

jsBindFunction jsStringW jsArg jsToStringW jsUndefined

gdiplus

GdipGetPropertyItemSize GdipDrawImageI GdipCreateBitmapFromScan0 GdipCreateBitmapFromFile GdipGetImageWidth GdipDeleteGraphics GdipGetImageGraphicsContext GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipBitmapLockBits GdipImageSelectActiveFrame GdipFree GdipDisposeImage GdipAlloc GdipCreateBitmapFromStream GdipGetPropertyItem GdipBitmapUnlockBits GdipImageGetFrameDimensionsCount GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipGraphicsClear GdipDrawImageRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipCloneImage

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmCreateContext ImmDestroyContext ImmAssociateContext

oleaut32

SysAllocString SysFreeString

usp10

ScriptFreeCache ScriptShape ScriptItemize

Name

.text

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

941KB

Virtual Size

940KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

488KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=37, id=241, version=40116,

count=216, id=243, version=40116,

count=40, id=242, version=40116,

count=2, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=261, version=27045,

count=2, id=257, version=30146,

count=6, id=199, version=41118,

count=29, id=259, version=24237,

count=22, id=260, version=24247,

count=459, id=261, version=24247,

count=14, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=4, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=648, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,

count=117, id=261, version=24237,

count=40, id=260, version=24237,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=43, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=599, id=1, productName=Unmarked objects,

count=80, id=265, version=24247,

count=1, id=256, version=24247,

count=1, id=255, version=24247,

count=1, id=151,

count=1, id=258, version=24247,