bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612

Sharing

Copy URL Twitter E-mail

General

Target
bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612
Size 248KB
Sample260901-2vmjwscl7t
SHA256 bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612
MD5 05a4afc9fb3f617546be53c0295d2623
SHA1 e8e3158115ad9186fa27cac0d50429eb9402dd49
SHA512 7f3f70be5c2f72de8eda83e8df0e01946ff3cc09600445e3868e203912426a3b34ee3f3cfe08ce4b4ddf6d712d213712be9d168fbb82b4ed0b91c2b5da544a86
SSDEEP 3072:hacKnbIhD4mbxtmbxMJB8PYV9Rk7D+HH2mrToo3yTHYibff3pZ0pFtJb:jKnchDHmTPYV4F8yDBTvpYFtp
TLSH
T12F44C610A3E1DB17E9B24A380CF6D7E50636FC50AA27890BEF02765F1532B10DF5AB56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612

File Explorer

bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612

.dll 248KB

bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612

IMPHASH d95d81363b9617cfc8d63a41ca983eea
SHA256 bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612
MD5 05a4afc9fb3f617546be53c0295d2623
SHA1 e8e3158115ad9186fa27cac0d50429eb9402dd49
SHA512 7f3f70be5c2f72de8eda83e8df0e01946ff3cc09600445e3868e203912426a3b34ee3f3cfe08ce4b4ddf6d712d213712be9d168fbb82b4ed0b91c2b5da544a86
SSDEEP 3072:hacKnbIhD4mbxtmbxMJB8PYV9Rk7D+HH2mrToo3yTHYibff3pZ0pFtJb:jKnchDHmTPYV4F8yDBTvpYFtp
TLSH
T12F44C610A3E1DB17E9B24A380CF6D7E50636FC50AA27890BEF02765F1532B10DF5AB56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

vDbgPrintExWithPrefix

advapi32

GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_Create ImageList_ReplaceIcon PropertySheetW

kernel32

DeleteCriticalSection EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetProcessHeap GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery lstrcmpW lstrcpyW lstrlenW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf abort bsearch calloc free fwrite memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp vfprintf wcschr wcscmp wcslen wcspbrk

netapi32

NetApiBufferFree NetLocalGroupAdd NetLocalGroupAddMembers NetLocalGroupDel NetLocalGroupDelMembers NetLocalGroupEnum NetLocalGroupGetInfo NetLocalGroupGetMembers NetLocalGroupSetInfo NetUserAdd NetUserDel NetUserEnum NetUserGetInfo NetUserGetLocalGroups NetUserSetInfo

user32

CheckDlgButton CheckRadioButton ClientToScreen DestroyIcon DestroyMenu DialogBoxParamW EnableWindow EndDialog GetClientRect GetDlgItem GetDlgItemTextW GetMenuDefaultItem GetParent GetSubMenu GetWindowLongW GetWindowTextLengthW IsDlgButtonChecked LoadIconW LoadImageW LoadMenuW LoadStringW MessageBoxW SendDlgItemMessageW SendMessageW SetDlgItemTextW SetFocus SetMenuDefaultItem SetWindowLongW TrackPopupMenu wsprintfW

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

71B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bbd1aeb6287eb567354f579689c01d1ddd0b9094a6b03cedfed4f21471623612

ntdll

advapi32

comctl32

kernel32

msvcrt

netapi32

user32

generic