c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3

Sharing

Copy URL Twitter E-mail

General

Target
c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3
Size 408KB
Sample260903-l1kpgsthpg
SHA256 c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3
MD5 7874d799eb2c6e5f959a4bf8f0a22f86
SHA1 d86640995c9a81317ac3c26a39c0c8587e4e9312
SHA512 aabf6d6f94fcf434b71bc6908c2f0b2659a4d11251279d0d2bdd57edd5a88f2711e301e81628fdb7948bbba34b0832441e0b5183ac6fb8b397272d990ade55d7
SSDEEP 6144:uPKi7uGmyOSemf88FR2DO5Kr/AylFO9ySemsVoCol1vUgClJ+:uK/GLOofXSoaOL5BCCb
TLSH
T1CD949E11BBD6C032CA4702750D9ADB4E6276F6A11F215AD3B3D82E5E9E712D39F33281
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3

File Explorer

c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3

.exe 408KB

c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3

IMPHASH 53ac61484d4ab43265bf0b29538f0606
SHA256 c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3
MD5 7874d799eb2c6e5f959a4bf8f0a22f86
SHA1 d86640995c9a81317ac3c26a39c0c8587e4e9312
SHA512 aabf6d6f94fcf434b71bc6908c2f0b2659a4d11251279d0d2bdd57edd5a88f2711e301e81628fdb7948bbba34b0832441e0b5183ac6fb8b397272d990ade55d7
SSDEEP 6144:uPKi7uGmyOSemf88FR2DO5Kr/AylFO9ySemsVoCol1vUgClJ+:uK/GLOofXSoaOL5BCCb
TLSH
T1CD949E11BBD6C032CA4702750D9ADB4E6276F6A11F215AD3B3D82E5E9E712D39F33281
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

206269

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\jk_9\workspace\GSP_DH3.RD012390_DB11_HS_L_windows\code_path\NPAPI__8d93c4\Bin\Win32\Win_x86_32\pdb\WebActiveX.pdb

winmm

PlaySoundW

kernel32

SizeofResource LoadResource FindResourceA GetModuleHandleA EnterCriticalSection LeaveCriticalSection FlushInstructionCache GetCurrentProcess MulDiv GlobalUnlock GlobalLock GlobalAlloc SetLastError SetEvent CloseHandle WaitForSingleObject CreateThread CreateEventA Sleep GetCommandLineA HeapFree GetProcessHeap InterlockedExchange CreateMutexA ReleaseMutex CreateFileW GlobalFree CreateFileA GetSystemTimeAsFileTime GetTickCount lstrcmpiW FindFirstFileA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP GetACP SetFilePointer ReadFile FlushFileBuffers GetConsoleMode GetConsoleCP GetFileType SetHandleCount HeapSize GetStdHandle WriteFile HeapCreate HeapDestroy VirtualFree TlsFree TlsSetValue TlsAlloc TlsGetValue ExitProcess GetCPInfo LCMapStringW LCMapStringA DeleteFileW IsDBCSLeadByte InterlockedDecrement InterlockedIncrement GetCurrentThreadId GetCurrentProcessId CreateToolhelp32Snapshot Thread32First Thread32Next lstrcmpiA lstrlenA GetLastError DeleteCriticalSection InitializeCriticalSection RaiseException lstrlenW WideCharToMultiByte QueryPerformanceCounter MultiByteToWideChar InterlockedCompareExchange GetThreadLocale LoadLibraryExA FindNextFileA FreeLibrary GetProcAddress GetModuleFileNameA VirtualQuery IsProcessorFeaturePresent GetEnvironmentStringsW CreateDirectoryW GetFileAttributesW SetFileAttributesW GetStartupInfoA SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW LoadLibraryA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetVersionExA GetFileAttributesA HeapReAlloc GetSystemInfo VirtualAlloc VirtualProtect HeapAlloc RtlUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetLocaleInfoA

user32

GetMessageA DispatchMessageA PostThreadMessageA UnregisterClassA RegisterClassExA GetKeyState InvalidateRect IsWindow GetFocus IsChild SetFocus UnionRect PtInRect CallWindowProcA BeginPaint EndPaint IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos GetDC ReleaseDC LoadCursorA GetClassInfoExA ShowWindow GetClientRect DefWindowProcA DestroyWindow PostMessageA GetWindowLongA SetWindowLongA CharNextA CreateWindowExA

gdi32

SetMapMode SetViewportOrgEx DeleteDC CreateDCA Rectangle SetTextAlign TextOutA CreateMetaFileA SaveDC SetWindowOrgEx SetWindowExtEx RestoreDC CloseMetaFile DeleteMetaFile CreateRectRgnIndirect GetDeviceCaps LPtoDP

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegEnumKeyExA

shell32

SHBrowseForFolderW SHGetPathFromIDListW

ole32

CoRegisterClassObject CoRevokeClassObject OleSaveToStream WriteClassStm CreateDataAdviseHolder OleRegGetMiscStatus CoCreateInstance OleRegEnumVerbs CreateOleAdviseHolder OleLoadFromStream CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoInitialize CoUninitialize OleRegGetUserType

oleaut32

UnRegisterTypeLi RegisterTypeLi OleCreatePropertyFrame SysFreeString SysAllocString SysAllocStringLen LoadTypeLi LoadRegTypeLi SysStringLen VariantChangeType VariantClear VariantInit SysStringByteLen SysAllocStringByteLen VarUI4FromStr

shlwapi

PathAppendA PathAddBackslashA PathRemoveFileSpecA

Sharing

General

Malware Config

Signatures

File Explorer

c83cd4700edbdbf07ec7c1c70fc610548cf4ad97afb9f8a4c79776ec0ddbfbb3

winmm

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

generic