6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03

Sharing

Copy URL Twitter E-mail

General

Target
6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03
Size 243KB
Sample260901-25m86sfc29
SHA256 6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03
MD5 ee695fda6b36dd4272a7121c4f3e2069
SHA1 928e2a2dd4709f3eed6147ea24841357990367ae
SHA512 bb53bec6714720e733a29a891635353914dc0d9fd94b2e98a72247760cf07ab47f068b7dd19adb5a42fd8fe7e2ca5aa5e2cf8b5d5f2905b9f8bd16e28f593dba
SSDEEP 6144:HDWjT1sRGxb1rVkjqNV3zf+1LalCX6O+Kbv:jwT1sgxJVkY5rU/Xjv
TLSH
T17A346D09F7D26A67EA7C017041DFD21B5664EC11DF448F07FE6C2259AA37322AA43B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03

File Explorer

6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03

.dll 243KB

6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03

IMPHASH 1e017c53c070bd59a043d8fbc34885f5
SHA256 6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03
MD5 ee695fda6b36dd4272a7121c4f3e2069
SHA1 928e2a2dd4709f3eed6147ea24841357990367ae
SHA512 bb53bec6714720e733a29a891635353914dc0d9fd94b2e98a72247760cf07ab47f068b7dd19adb5a42fd8fe7e2ca5aa5e2cf8b5d5f2905b9f8bd16e28f593dba
SSDEEP 6144:HDWjT1sRGxb1rVkjqNV3zf+1LalCX6O+Kbv:jwT1sgxJVkY5rU/Xjv
TLSH
T17A346D09F7D26A67EA7C017041DFD21B5664EC11DF448F07FE6C2259AA37322AA43B4B
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

vDbgPrintExWithPrefix

comctl32

ImageList_Add ImageList_Create ImageList_Destroy InitCommonControlsEx

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW ExpandEnvironmentStringsW FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesW GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GetWindowsDirectoryW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MultiByteToWideChar QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrlenW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _strnicmp _unlock _vsnprintf abort atoi bsearch calloc free fwrite isspace malloc memchr memcmp memcpy memmove memset realloc sprintf strchr strcmp strcpy strcspn strncmp strstr tolower vfprintf wcschr wcslen wcsrchr wcsstr strtol _wcsnicmp _wcsdup _stricmp

ole32

CoCreateInstance OleCreate OleInitialize OleSetContainedObject OleUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

PathCombineW

gdi32

CreateFontIndirectW GetObjectW GetStockObject LineTo MoveToEx SelectObject SetDCPenColor

user32

BeginPaint ClientToScreen CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EndPaint FrameRect GetClientRect GetDesktopWindow GetMessageW GetParent GetSubMenu GetSysColor GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextA LoadBitmapW LoadCursorW LoadIconW LoadMenuW LoadStringW MoveWindow PostQuitMessage RegisterClassExW ReleaseCapture SendMessageW SetCapture SetMenuItemInfoW SetRect SetWindowLongW SetWindowPos ShowWindow TrackPopupMenu TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

197B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6b66628a4c6c9006b4701f9359f1cf177a699c55193a1f0390c8c794cac75c03

ntdll

comctl32

kernel32

msvcrt

ole32

oleaut32

shlwapi

gdi32

user32

generic