0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b

Sharing

Copy URL Twitter E-mail

General

Target
0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b
Size 2.4MB
Sample260903-ryhd8sam4v
SHA256 0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b
MD5 0d8166aa96a8d3b38b4a92f53bcfca23
SHA1 f5f81ad78912f4815613140125c8a4e6d1e03af5
SHA512 f069b51fe593bfeb1fe1fa8891af69bb058bc00c124724ce862c499d5b73b98729475a1d5f1288c7da780b9ac2c6d2240bb4cbcf4e9317b274c191329d89ecfe
SSDEEP 49152:/vJSurc+lJ75fiBIEhH1zxPHudW4Sur3/9cX//9PmJ09A:HJSurc+lJ75f4HhH1zxPHudzSS3/9cXQ
TLSH
T111B56D23F290B01EE66389B25CB8A27B5939BC391594B147B3C05F093972BD7D845B2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b

File Explorer

0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b

.exe 2.4MB

0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b

IMPHASH d29d88c3be703b32312299430d3b3130
SHA256 0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b
MD5 0d8166aa96a8d3b38b4a92f53bcfca23
SHA1 f5f81ad78912f4815613140125c8a4e6d1e03af5
SHA512 f069b51fe593bfeb1fe1fa8891af69bb058bc00c124724ce862c499d5b73b98729475a1d5f1288c7da780b9ac2c6d2240bb4cbcf4e9317b274c191329d89ecfe
SSDEEP 49152:/vJSurc+lJ75fiBIEhH1zxPHudW4Sur3/9cX//9PmJ09A:HJSurc+lJ75f4HhH1zxPHudzSS3/9cXQ
TLSH
T111B56D23F290B01EE66389B25CB8A27B5939BC391594B147B3C05F093972BD7D845B2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

78500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoTaskMemAlloc CoInitialize CoUninitialize

shell32

SHGetFileInfoA

olepro32

OleTranslateColor

kernel32

GetProcAddress VirtualProtect RtlMoveMemory HeapFree GetModuleHandleA GetProcessHeap RtlZeroMemory LoadLibraryA lstrcmpA FreeLibrary lstrlenA GetVersion MulDiv CloseHandle lstrlenW lstrcmpiA HeapAlloc MultiByteToWideChar

comctl32

ImageList_DrawEx ImageList_DragMove ImageList_GetIcon ImageList_AddIcon ImageList_DragLeave ImageList_DragEnter ImageList_BeginDrag InitCommonControlsEx ImageList_EndDrag ImageList_GetIconSize ImageList_GetImageCount ImageList_Create DllGetVersion ImageList_DragShowNolock ImageList_Draw ImageList_AddMasked InitCommonControls ImageList_Destroy

gdi32

GetObjectA SelectObject GetDeviceCaps CreateFontIndirectA DeleteDC CreateCompatibleDC CreateDCA CreateDIBSection GetPixel SetTextColor CreateBrushIndirect CreatePenIndirect OffsetWindowOrgEx StretchDIBits DeleteObject CreateCompatibleBitmap GetTextExtentPoint32A BitBlt SetBkColor

user32

SetWindowPos DestroyIcon LoadImageA RemovePropA GetWindowRect CreateWindowExA ScreenToClient SetWindowsHookExA ReleaseCapture FillRect InvalidateRect DrawStateA GetKeyState UnhookWindowsHookEx IsRectEmpty UnionRect VkKeyScanA FindWindowExA EnableWindow MoveWindow SetActiveWindow OffsetRect DestroyWindow GetSysColor RedrawWindow DrawTextA SetFocus GetScrollInfo SetWindowLongA SystemParametersInfoA SendMessageA ReleaseDC VkKeyScanW WindowFromPoint DestroyAcceleratorTable PostMessageA CreateAcceleratorTableA InflateRect GetFocus GetDC CallNextHookEx GetSystemMetrics GetAsyncKeyState SetPropA SetTimer DestroyCursor GetActiveWindow KillTimer GetClientRect GetCursorPos GetPropA UpdateWindow IntersectRect

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaVarMove __vbaStrI4 __vbaRedimPreserveVar __vbaVarVargNofree __vbaCyMul __vbaAryMove __vbaFreeVar ord588 __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord697 __vbaEnd __vbaFreeVarList __vbaVargObjAddref _adj_fdiv_m64 ord698 __vbaFpCDblR8 EVENT_SINK_Invoke __vbaVarIndexStore __vbaNextEachVar __vbaRaiseEvent __vbaFreeObjList ord516 ord517 __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni ord626 ord519 __vbaVarSetVarAddref __vbaI2Abs __vbaI4Sgn __vbaCopyBytes __vbaResume __vbaForEachCollAd __vbaStrCat ord660 ord553 __vbaLsetFixstr __vbaBoolErrVar __vbaStrDate ord661 __vbaRecDestruct __vbaSetSystemError ord662 __vbaLenBstrB __vbaHresultCheckObj ord556 __vbaLenVar _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaVarCmpGe __vbaAryDestruct __vbaLateMemSt __vbaVarIndexLoadRefLock EVENT_SINK2_Release ord592 ord593 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord594 __vbaI4Abs __vbaCyAdd ord595 __vbaOnError __vbaObjSet __vbaVargObj _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 ord305 __vbaCyStr ord520 __vbaStrFixstr __vbaBoolVar __vbaFpR8 __vbaBoolVarNull __vbaRefVarAry _CIsin ord709 VarPtr ord631 __vbaErase ord632 __vbaVargVarMove __vbaNextEachCollObj __vbaVarZero __vbaVarCmpGt ord525 __vbaChkstk __vbaFileClose ord526 __vbaCyVar EVENT_SINK_AddRef ord527 __vbaExitEachColl __vbaStrCmp __vbaPutOwner3 __vbaAryConstruct2 __vbaVarTstEq __vbaDateR8 __vbaCyI4 ord561 __vbaObjVar PutMem1 __vbaI2I4 ord562 PutMem2 DllFunctionCall __vbaVarOr ord563 __vbaFpUI1 __vbaCySub PutMem4 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaR4Var ord568 __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaR8Cy __vbaStrR8 __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 __vbaUI1I2 ord601 _CIsqrt __vbaLateIdCallSt __vbaRedimVar __vbaVarAnd __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaVarMul __vbaStr2Vec ord710 __vbaFpCmpCy __vbaUI1I4 __vbaExceptHandler ord711 ord313 ord712 __vbaStrToUnicode __vbaDateStr ord606 _adj_fprem _adj_fdivr_m64 __vbaI2Str __vbaLateIdStAd ord714 ord607 GetMem1 __vbaFailedFriend ord608 GetMem2 ord715 ord716 ord609 __vbaVarCmpLe __vbaFPException __vbaInStrVar GetMem4 ord717 ord319 __vbaGetOwner3 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaCheckType __vbaDateVar __vbaMidStmtBstrB __vbaI2Var __vbaFileSeek __vbaStopExe ord537 ord644 ord538 _CIlog ord539 __vbaErrorOverflow __vbaFileOpen ord648 ord570 __vbaVar2Vec __vbaInStr __vbaR8Str __vbaNew2 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord685 ord100 __vbaVarSetVar __vbaI4Var __vbaVarCmpEq __vbaFpCy ord611 __vbaVarAdd __vbaLateMemCall __vbaAryLock ord320 __vbaStrToAnsi __vbaStrComp __vbaVarDup ord321 __vbaVerifyVarObj __vbaFpI2 ord614 __vbaVarLateMemCallLd ord616 __vbaVarCopy __vbaFpI4 __vbaRecDestructAnsi ord617 __vbaLateMemCallLd _CIatan __vbaUI1Str __vbaAryCopy ord618 __vbaStrMove __vbaCastObj __vbaStrVarCopy ord619 __vbaForEachVar __vbaI4Cy ord542 __vbaVarNeg __vbaLateIdNamedCall ord543 ord650 _allmul ord544 __vbaLateIdSt __vbaAryRecCopy ord545 _CItan ord546 __vbaNextEachCollAd __vbaUI1Var ord547 __vbaAryUnlock __vbaVarForNext _CIexp __vbaStrCy __vbaMidStmtBstr __vbaRecAssign __vbaI4ErrVar __vbaFreeStr __vbaFreeObj ord581

Sharing

General

Malware Config

Signatures

File Explorer

0ade6d5af969c391db0cfddbb34c8a35bbc89163409b90eb3f155f1f8f586f1b

ole32

shell32

olepro32

kernel32

comctl32

gdi32

user32

msvbvm60

generic