8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc

Sharing

Copy URL Twitter E-mail

General

Target
8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc
Size 2.7MB
Sample260903-lf4lvstdqd
SHA256 8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc
MD5 af82460c9f35dbcb023d00f48e3571fe
SHA1 73dc87b307a55895f1c9c0c02ee6d9ef99a1902d
SHA512 0108e819b5ccb2e0e266feb59322b3e473880445d08a9fd9406fdc7afe562bfef3fb3dae67e4c449a21ac85d5bf754baf9bec630ac22ff0b1a7e252d2c5f2eb7
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3u:CebAjOKn3wRKRJ3u
TLSH
T1C7D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc

File Explorer

8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc

.exe 2.7MB

8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc

IMPHASH 14b4507f976e32ec2f82aea1cd56dda1
SHA256 8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc
MD5 af82460c9f35dbcb023d00f48e3571fe
SHA1 73dc87b307a55895f1c9c0c02ee6d9ef99a1902d
SHA512 0108e819b5ccb2e0e266feb59322b3e473880445d08a9fd9406fdc7afe562bfef3fb3dae67e4c449a21ac85d5bf754baf9bec630ac22ff0b1a7e252d2c5f2eb7
SSDEEP 49152:GMn7Ix1oDK+bAvrHq98rekn3nt7/LKRGnRJ3u:CebAjOKn3wRKRJ3u
TLSH
T1C7D57C03F2A880EAD49EC178C71A9627FB72B8891630B7DF16E44B652F27B605F1D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2130360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

client.pdb

kernel32

GetVolumeInformationW GetDiskFreeSpaceExW DeviceIoControl OpenProcess GetExitCodeProcess WaitForMultipleObjects GetProcessTimes GetSystemTimes GetProcessIoCounters GetFileAttributesW CreateProcessW GetWindowsDirectoryW VirtualQueryEx GetTickCount64 GetLogicalDrives GlobalMemoryStatusEx GetSystemDirectoryW ReadFile GetOverlappedResult CancelIo PostQueuedCompletionStatus CreateEventW ExitProcess CreateWaitableTimerExW FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI GetSystemInfo GetSystemTimePreciseAsFileTime ReadFileEx SleepEx WriteFileEx CreateThread DeleteFileW GetTempPathW GetModuleFileNameW GetFileInformationByHandleEx GetFileInformationByHandle SetFileTime CreateFileW FindFirstFileExW GetFullPathNameW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx GetModuleHandleW SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetFinalPathNameByHandleW SwitchToThread GlobalUnlock GlobalLock HeapReAlloc GetCurrentThread SetThreadStackGuarantee LoadLibraryA WaitForSingleObject SetFileInformationByHandle MoveFileExW GlobalSize GlobalAlloc GetComputerNameExW WaitForMultipleObjectsEx SetThreadPriority GetCurrentThreadId SetEvent CreateEventA CopyFileExW FindClose FindNextFileW GetModuleHandleA Sleep FormatMessageW HeapAlloc HeapFree GetProcessHeap LoadLibraryExA GetProcAddress FreeLibrary DuplicateHandle SetHandleInformation TerminateProcess IsProcessorFeaturePresent SetLastError LocalFree GetDriveTypeW GlobalFree CloseHandle SetWaitableTimer GetLastError SetUnhandledExceptionFilter InitializeSListHead UnhandledExceptionFilter IsDebuggerPresent lstrlenW MultiByteToWideChar WideCharToMultiByte AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal ReadProcessMemory FormatMessageA SystemTimeToFileTime OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection

combase

CoTaskMemFree

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtReadFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateFile NtWriteFile RtlGetVersion NtOpenFile NtCreateNamedPipeFile RtlNtStatusToDosError

ole32

CoSetProxyBlanket CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity

mfplat

MFCreateSample MFStartup MFShutdown MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

oleaut32

SysAllocString GetErrorInfo SysFreeString VariantClear SysStringLen

ws2_32

socket getaddrinfo freeaddrinfo recv send ioctlsocket closesocket connect bind setsockopt getpeername WSAGetLastError getsockname WSACleanup getsockopt WSAIoctl WSASocketW WSASend shutdown WSAStartup

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

secur32

LsaGetLogonSessionData DeleteSecurityContext QueryContextAttributesW AcquireCredentialsHandleA LsaFreeReturnBuffer LsaEnumerateLogonSessions EncryptMessage FreeContextBuffer AcceptSecurityContext FreeCredentialsHandle DecryptMessage ApplyControlToken InitializeSecurityContextW

crypt32

CertDuplicateCertificateContext CertDuplicateStore CertDuplicateCertificateChain CertFreeCertificateContext CertEnumCertificatesInStore CertAddCertificateContextToStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertFreeCertificateChain CertCloseStore CertOpenStore

advapi32

RevertToSelf GetLengthSid IsValidSid ImpersonateAnonymousToken SystemFunction036 GetTokenInformation OpenProcessToken GetUserNameW LookupAccountSidW CopySid RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

user32

ShowWindow FindWindowA EmptyClipboard EnumDisplaySettingsExW GetMonitorInfoW EnumDisplayMonitors CloseClipboard OpenClipboard SetClipboardData MessageBoxA GetClipboardData BlockInput

shlwapi

AssocQueryStringW

gdi32

GetObjectW GetDIBits StretchBlt SetStretchBltMode SelectObject CreateCompatibleBitmap CreateDCW GetDeviceCaps DeleteDC CreateCompatibleDC DeleteObject

iphlpapi

GetIfTable2 GetIfEntry2 FreeMibTable GetAdaptersAddresses GetIpForwardTable

powrprof

SetSuspendState CallNtPowerInformation

shell32

SHGetKnownFolderPath CommandLineToArgvW

psapi

GetModuleFileNameExW GetPerformanceInfo

pdh

PdhOpenQueryA PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhRemoveCounter PdhCloseQuery

netapi32

NetApiBufferFree NetUserGetLocalGroups NetUserGetInfo NetUserEnum

vcruntime140

__current_exception memcpy __CxxFrameHandler3 strrchr __C_specific_handler memmove memcmp strchr memchr memset __current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr log _dclass fabs pow roundf

api-ms-win-crt-string-l1-1-0

strncmp strcspn strspn strlen wcslen strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment terminate _initterm_e _configure_narrow_argv exit _exit __p___argc _crt_atexit _set_app_type _seh_filter_exe _endthreadex _register_onexit_function _initialize_onexit_table _beginthreadex __p___argv strerror _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-heap-l1-1-0

free realloc malloc _msize _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode __stdio_common_vfprintf __stdio_common_vsnprintf_s __acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

8749695aa732cb26675206e20d3d96dfde07b4836fc8b4a4b4719fc4a05bccfc

kernel32

combase

ntdll

ole32

mfplat

mfreadwrite

mf

oleaut32

ws2_32

api-ms-win-core-synch-l1-2-0

secur32

crypt32

advapi32

bcrypt

bcryptprimitives

user32

shlwapi

gdi32

iphlpapi

powrprof

shell32

psapi

pdh

netapi32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic