01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294

Sharing

Copy URL Twitter E-mail

General

Target
01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294
Size 8.3MB
Sample260903-mc1apsvbqh
SHA256 01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294
MD5 00291418b957def09eb85a626f5f3210
SHA1 ba70716dacdcf3f9f67e146a5710bd8470ae88f3
SHA512 9b89989d214fb887b665b9d715f0a2e1eab89464a4c550a7e603d3787a26c139926374e901f6027d821fafc2376e8acc625bf9ad180cf039c4131cd255ba5c29
SSDEEP 98304:NewO14cXzoUefHxy/cTRdHy7hsCcD5mCtx+x:cwO14cXzoUefHk/cTRdH0csCu
TLSH
T1E096D5257B5B996CD09BC4B482478A63092030DB0B3979FF549896382F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294

File Explorer

01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294

.exe 8.3MB

01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294

IMPHASH 022692574e4976e5a261160c7eefd182
SHA256 01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294
MD5 00291418b957def09eb85a626f5f3210
SHA1 ba70716dacdcf3f9f67e146a5710bd8470ae88f3
SHA512 9b89989d214fb887b665b9d715f0a2e1eab89464a4c550a7e603d3787a26c139926374e901f6027d821fafc2376e8acc625bf9ad180cf039c4131cd255ba5c29
SSDEEP 98304:NewO14cXzoUefHxy/cTRdHy7hsCcD5mCtx+x:cwO14cXzoUefHk/cTRdH0csCu
TLSH
T1E096D5257B5B996CD09BC4B482478A63092030DB0B3979FF549896382F7EBF56F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5974976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Soda_lol.pdb

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey EventUnregister EventWriteTransfer EventRegister EventSetInformation RegGetValueW

ntdll

NtCreateNamedPipeFile NtWriteFile RtlNtStatusToDosError NtReadFile NtOpenFile RtlGetVersion

kernel32

FlsGetValue FlsSetValue FlsAlloc RaiseException RtlPcToFileHeader LCIDToLocaleName FlsFree GetUserDefaultUILanguage EncodePointer FindNextFileW GetTempPathW WaitForMultipleObjects InitializeSListHead CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar SetUnhandledExceptionFilter SetEnvironmentVariableW DeleteFileW GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetCurrentDirectoryW AcquireSRWLockExclusive SetThreadStackGuarantee AddVectoredExceptionHandler ReleaseSRWLockExclusive GetStdHandle GetEnvironmentStringsW GetExitCodeProcess CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DuplicateHandle GetCurrentProcess LoadLibraryW LoadLibraryA GetOverlappedResult OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetLastError GetProcessHeap HeapFree LoadLibraryExW RtlUnwindEx FreeLibrary ReadFile ReadFileEx GetCurrentProcessId lstrlenW SetHandleInformation GetModuleHandleW CreateEventW CreateThread QueryPerformanceCounter QueryPerformanceFrequency HeapReAlloc SetFileTime SetFileInformationByHandle GetFullPathNameW SetLastError SleepEx WriteFileEx WaitForSingleObject FreeEnvironmentStringsW CompareStringOrdinal GetEnvironmentVariableW GetModuleHandleA Sleep GetProcAddress CloseHandle CreateFileW GetCurrentThread InitializeCriticalSectionEx GetCurrentThreadId DeleteCriticalSection LoadLibraryExA GetConsoleMode HeapAlloc GetFileInformationByHandle GetFileAttributesW FormatMessageW CreateDirectoryW SetWaitableTimer

user32

GetWindowDC VkKeyScanW GetMenuBarInfo DestroyMenu TrackPopupMenu PostQuitMessage OffsetRect DrawTextW SetMenu DestroyWindow RemoveMenu AppendMenuW InsertMenuW CheckMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DrawMenuBar CreatePopupMenu TranslateAcceleratorW AdjustWindowRect CreateMenu RedrawWindow DrawIconEx GetMenuItemInfoW CreateIcon GetKeyboardLayout ToUnicodeEx MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState SendMessageW IsIconic SetWindowLongW EnableMenuItem GetSystemMenu SendInput SetForegroundWindow GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible SetWindowTextW ValidateRect GetWindowTextLengthW PostThreadMessageW EnumDisplayMonitors PeekMessageW MonitorFromPoint SetWindowDisplayAffinity GetRawInputData SystemParametersInfoA SetPropW DestroyIcon ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetUpdateRect TranslateMessage DispatchMessageW RegisterRawInputDevices PostMessageW LoadCursorW ScreenToClient RegisterWindowMessageA GetWindow GetWindowLongW GetClientRect ClientToScreen SetParent GetWindowTextW SetFocus ShowWindow GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled GetCursorPos ReleaseDC GetDC IsProcessDPIAware MonitorFromWindow MonitorFromRect EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW GetMonitorInfoW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MapWindowPoints DefWindowProcW MapVirtualKeyW FlashWindowEx GetMessageW GetSystemMetrics FillRect RegisterTouchWindow IsWindow CreateWindowExW AdjustWindowRectEx GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos SystemParametersInfoW SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

SetWindowSubclass RemoveWindowSubclass DefSubclassProc TaskDialogIndirect

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance OleInitialize RegisterDragDrop CoInitializeEx CoTaskMemFree CoTaskMemAlloc CoUninitialize RevokeDragDrop

gdi32

SetTextColor SetBkMode DeleteObject DeleteDC GetDeviceCaps CreateDIBSection CreateRectRgn SelectObject CombineRgn CreateSolidBrush BitBlt CreateCompatibleDC

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

shlwapi

SHCreateMemStream

shell32

ShellExecuteW SHGetKnownFolderPath DragQueryFileW DragFinish SHAppBarMessage

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

ws2_32

send WSAGetLastError freeaddrinfo connect WSACleanup WSAStartup WSASocketW getaddrinfo closesocket

api-ms-win-crt-math-l1-1-0

roundf trunc round __setusermatherr pow floor

api-ms-win-crt-string-l1-1-0

wcscmp wcslen strcpy_s _wcsicmp

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-runtime-l1-1-0

_set_app_type _initterm_e _c_exit _seh_filter_exe _cexit _initterm _exit _register_thread_local_exe_atexit_callback _get_initial_narrow_environment abort __p___argv exit __p___argc terminate _crt_atexit _configure_narrow_argv _register_onexit_function _initialize_onexit_table _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc free malloc _set_new_mode _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

01b9938f9a45217221d6be73484819667740694d30eee89cb6c2ac4ebeb80294

bcryptprimitives

advapi32

ntdll

kernel32

user32

api-ms-win-core-synch-l1-2-0

comctl32

ole32

gdi32

dwmapi

shlwapi

shell32

oleaut32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic