42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952

Sharing

Copy URL Twitter E-mail

General

Target
42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952
Size 819KB
Sample260901-229m1ayfnc
SHA256 42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952
MD5 e4ded72fb5f023a181661e0c3789fabd
SHA1 054341537a8e1b69c2b3aeb50822b9f2a0f0326a
SHA512 08d659c4fab81f33967e806d9ad5ca2f1066a002ffb46e60eb248d80ff8c480b7f67946ab763cf2b8fb09f3d2a76741a778d8fdbcca55a3bf71c5543e65550e7
SSDEEP 6144:Zalf9sJpJTpNALpJ2AMIpOpyRXRzpyRuMID7KTrEEDWSvxL5:2F6pJTpNgpA6pOpSpDd6
TLSH
T1F205C501A7F4D606F6F76B755DB293EA0D36BD52A930DA1FA784368F1830A50CF24722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952

File Explorer

42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952

.dll 819KB

42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952

IMPHASH acb597bdaa430b6b4cb22b573dc2d27f
SHA256 42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952
MD5 e4ded72fb5f023a181661e0c3789fabd
SHA1 054341537a8e1b69c2b3aeb50822b9f2a0f0326a
SHA512 08d659c4fab81f33967e806d9ad5ca2f1066a002ffb46e60eb248d80ff8c480b7f67946ab763cf2b8fb09f3d2a76741a778d8fdbcca55a3bf71c5543e65550e7
SSDEEP 6144:Zalf9sJpJTpNALpJ2AMIpOpyRXRzpyRuMID7KTrEEDWSvxL5:2F6pJTpNgpA6pOpSpDd6
TLSH
T1F205C501A7F4D606F6F76B755DB293EA0D36BD52A930DA1FA784368F1830A50CF24722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlAssert

advapi32

ChangeServiceConfigW CloseServiceHandle OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegEnumKeyExW RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_ReplaceIcon PropertySheetW

comdlg32

GetOpenFileNameW

devmgr

DeviceCreateHardwarePageEx

kernel32

CloseHandle CreateProcessW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesW GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetSystemDirectoryW GetSystemTimeAsFileTime GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW QueryPerformanceCounter SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock _vsnwprintf _wcsdup _wcsicmp _wtoi abort calloc free fwrite memcmp memmove strncmp vfprintf wcschr wcscmp wcslen wcsrchr

setupapi

SetupCloseInfFile SetupDefaultQueueCallbackW SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiGetINFClassW SetupDiSetDeviceRegistryPropertyW SetupInitDefaultQueueCallback SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW SetupOpenInfFileW SetupTermDefaultQueueCallback

shell32

ShellExecuteW

winmm

PlaySoundW mciSendCommandW midiOutGetDevCapsW midiOutGetNumDevs mixerClose mixerGetControlDetailsW mixerGetDevCapsW mixerGetID mixerGetLineControlsW mixerGetLineInfoW mixerGetNumDevs mixerOpen mixerSetControlDetails waveInGetDevCapsW waveInGetNumDevs waveOutGetDevCapsW waveOutGetNumDevs

gdi32

DeleteObject

user32

CheckDlgButton DestroyIcon DrawIconEx EnableWindow FindWindowW GetDlgItem GetParent GetSystemMetrics GetWindowLongW IsDlgButtonChecked KillTimer LoadIconW LoadImageW LoadStringW MessageBoxW SendDlgItemMessageW SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongW SetWindowTextW ShowWindow

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

467B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

711KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

42bd8792eb1a91affc9b01f46c3757d0b27c785055d9ef624216f085f633c952

ntdll

advapi32

comctl32

comdlg32

devmgr

kernel32

msvcrt

setupapi

shell32

winmm

gdi32

user32

generic