32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53

Sharing

Copy URL Twitter E-mail

General

Target
32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53
Size 1.6MB
Sample260831-r1p7vsbp21
SHA256 32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53
MD5 c127f1d4e8546aa4ae62a08ade23277f
SHA1 2022128e10b192ae423b21f3b4de54f18d510faf
SHA512 5c9caf91eec35a38e325d91f4eb3370f005310bb60306a8227ee38d9842eef4a1cd8f208355cff787140cdf8536215a3d8a63338be60d3b9ce7b40d1149e8e59
SSDEEP 24576:ka08ZSCRM3qN54j49LEMjydsqjnhMgeiCl7G0nehbGZpbD:ka081yqN54j49LEMjoDmg27RnWGj
TLSH
T14075E09763A405FAE0574079CD83CA12F6367408233463DF4AE4DAE12F93EE69A3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53

File Explorer

32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53

.exe 1.6MB

32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53

IMPHASH cfc72b54eec6e472e94998c57ae60121
SHA256 32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53
MD5 c127f1d4e8546aa4ae62a08ade23277f
SHA1 2022128e10b192ae423b21f3b4de54f18d510faf
SHA512 5c9caf91eec35a38e325d91f4eb3370f005310bb60306a8227ee38d9842eef4a1cd8f208355cff787140cdf8536215a3d8a63338be60d3b9ce7b40d1149e8e59
SSDEEP 24576:ka08ZSCRM3qN54j49LEMjydsqjnhMgeiCl7G0nehbGZpbD:ka081yqN54j49LEMjoDmg27RnWGj
TLSH
T14075E09763A405FAE0574079CD83CA12F6367408233463DF4AE4DAE12F93EE69A3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

285520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BWA\BonjourWin_x64-94\srcroot\mDNSWindows\SystemService\x64\Release\mDNSResponder.pdb

ws2_32

closesocket WSAStringToAddressA WSAGetLastError recv listen accept inet_addr WSACreateEvent WSAEventSelect WSACloseEvent WSAEnumNetworkEvents WSAStartup WSACleanup WSAAddressToStringA htons connect ioctlsocket getsockname WSARecvFrom socket setsockopt WSAIoctl bind sendto send htonl

iphlpapi

GetIpForwardTable GetAdaptersInfo GetNetworkParams GetPerAdapterInfo GetBestInterface CreateIpForwardEntry DeleteIpForwardEntry GetIpAddrTable

netapi32

NetGetJoinInformation NetShareEnum NetApiBufferFree

powrprof

SetSuspendState

kernel32

GetLastError GetComputerNameExA WideCharToMultiByte SetEvent WaitForMultipleObjects CreateEventW GetProcAddress LoadLibraryW SetWaitableTimer CloseHandle DeviceIoControl CreateFileA GetComputerNameExW GetTickCount GlobalAlloc GlobalFree Sleep WaitForSingleObject GetVersionExW CreateWaitableTimerW OpenThread GetCurrentThreadId ResetEvent TerminateThread MultiByteToWideChar GetModuleFileNameW CancelWaitableTimer GetSystemPowerStatus GetFullPathNameW SetConsoleCtrlHandler GetModuleHandleW HeapSetInformation SetLastError FormatMessageA FlsAlloc ExitProcess WriteFile GetStdHandle GetVersion FreeLibrary HeapCreate GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwindEx CreateFileW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetHandleCount GetFileType GetStartupInfoW LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetStringTypeW WriteConsoleW SetFilePointer SetStdHandle HeapSize QueueUserAPC FlsFree FlsSetValue FlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo RtlCaptureContext GetSystemTimeAsFileTime HeapAlloc HeapFree EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection HeapReAlloc ExitThread CreateThread ResumeThread GetCommandLineW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry

user32

LoadStringW

advapi32

LsaNtStatusToWinError RegisterServiceCtrlHandlerExW DeregisterEventSource StartServiceCtrlDispatcherW SetServiceStatus QueryServiceStatus ControlService DeleteService CreateServiceW StartServiceW RegNotifyChangeKeyValue RegisterEventSourceW ReportEventA LockServiceDatabase OpenServiceW ChangeServiceConfig2W UnlockServiceDatabase OpenSCManagerW EnumServicesStatusW CloseServiceHandle LsaOpenPolicy LsaRetrievePrivateData LsaFreeMemory LsaClose RegOpenKeyExW RegCreateKeyA RegQueryInfoKeyW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegCreateKeyW RegSetValueExW RegCloseKey

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

Name

.text

Size

314KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

32b440da6681458a4f59d32be75029dc9195ec1d0d3a230cc87b04a592b5ee53

ws2_32

iphlpapi

netapi32

powrprof

kernel32

user32

advapi32

ole32

oleaut32

generic