d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d

Sharing

Copy URL Twitter E-mail

General

Target
d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d
Size 225KB
Sample260905-db36jadp2z
SHA256 d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d
MD5 af1af11c5cc38e9ccad511ed46da15c0
SHA1 f91c77d49c89e36809bbe6463cecf8c61081c83d
SHA512 a748e352c0c073fe50ee64c74cd72ed2fb1803aa06bb330d0205db09b34c7f99105f1c6ae2af7b8db2c079f4b114e0e20fb9c9f1009d6ab8450e0502345a4f07
SSDEEP 6144:0OpaoC5GHfXgG3FatRrH8k5PVQhN9TBqXUcV:tpao3Itj0hN9TE
TLSH
T17A34BE11E3204437C4F611BBA4B7A679972CBF625328B4CB66D87E961F341E61E3078B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d

File Explorer

d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d

.dll 225KB

d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d

IMPHASH e967dafc8550d0f848a351ac3575fd79
SHA256 d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d
MD5 af1af11c5cc38e9ccad511ed46da15c0
SHA1 f91c77d49c89e36809bbe6463cecf8c61081c83d
SHA512 a748e352c0c073fe50ee64c74cd72ed2fb1803aa06bb330d0205db09b34c7f99105f1c6ae2af7b8db2c079f4b114e0e20fb9c9f1009d6ab8450e0502345a4f07
SSDEEP 6144:0OpaoC5GHfXgG3FatRrH8k5PVQhN9TBqXUcV:tpao3Itj0hN9TE
TLSH
T17A34BE11E3204437C4F611BBA4B7A679972CBF625328B4CB66D87E961F341E61E3078B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

malloc ??2@YAPAXI@Z ??3@YAXPAX@Z free _strnicmp memmove realloc sprintf atoi atof rename _ftol strcpy strlen memcpy memset strcmp strtol isxdigit toupper mktime _strcmpi fopen fclose fwrite _onexit __dllonexit _except_handler3 _CxxThrowException wcslen ??1type_info@@UAE@XZ

user32

CallWindowProcA WindowFromDC UpdateWindow UnhookWindowsHookEx TranslateMessage ShowWindow SetWindowsHookExA SetWindowTextW SetWindowTextA SetWindowPos SetWindowLongA SetTimer SetRect SetForegroundWindow SetDlgItemTextA SetCursor SendMessageA SendDlgItemMessageA ScreenToClient ReleaseDC RegisterClassExA PtInRect PostQuitMessage OffsetRect MessageBoxW MessageBoxA LoadImageW LoadImageA LoadIconW LoadIconA LoadCursorA LoadBitmapW LoadBitmapA KillTimer InvalidateRect GetWindowRect GetWindowLongA GetSystemMetrics GetSysColor GetParent GetMessageW GetMessageA GetDlgItemTextW GetDlgItemTextA GetDlgItem GetDlgCtrlID GetDC GetCursorPos GetClientRect FindWindowExA FindWindowA EndDialog EnableWindow DrawTextA DrawIconEx DispatchMessageA DialogBoxParamA DestroyWindow DefWindowProcA CreateWindowExW CreateWindowExA CreateDialogIndirectParamW CallNextHookEx wsprintfA IsWindow EnumChildWindows RegisterWindowMessageA SendMessageTimeoutA GetClassNameA CreateDialogIndirectParamA

ole32

CLSIDFromString CoGetMalloc CoCreateInstance CoUninitialize CreateStreamOnHGlobal GetHGlobalFromStream CoInitialize

oleaut32

SysFreeString OleLoadPicture VariantClear SysAllocString

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegEnumKeyExA RegCloseKey

oleacc

ObjectFromLresult

shell32

SHGetFolderPathW ShellExecuteExA

gdiplus

GdipSaveImageToStream GdiplusStartup GdipGetImageEncodersSize GdipGetImageEncoders GdipDisposeImage GdipCreateBitmapFromHBITMAP

shlwapi

PathIsRelativeA PathIsDirectoryA StrToIntExA StrTrimA StrStrIA PathAddBackslashA PathFindFileNameA PathIsRootA PathRemoveBackslashA PathRemoveFileSpecA PathUnquoteSpacesA StrChrA StrStrIW PathAppendW PathFindExtensionA

gdi32

GetPixel GetCurrentObject ExcludeClipRect DeleteObject GetStockObject CreateSolidBrush CreateCompatibleDC BitBlt GetObjectA GetBitmapBits SetBitmapBits CreateFontA PatBlt RoundRect SelectClipRgn SelectObject SetBkMode SetStretchBltMode SetTextColor StretchBlt CreateDIBSection CreateDIBitmap DeleteDC

kernel32

RemoveDirectoryA MultiByteToWideChar MapViewOfFile LockResource LoadResource LoadLibraryA IsBadStringPtrA GlobalUnlock GlobalSize GlobalLock GlobalFree GlobalAlloc GetTempPathA GetSystemTime GetModuleFileNameA GetLocalTime GetFileTime GetCurrentThreadId FreeResource FindResourceA FindNextFileA FindFirstFileA FindClose RtlMoveMemory DeviceIoControl DeleteFileA CreateRemoteThread CreateFileMappingA CreateDirectoryA GetCurrentThread lstrcpyA lstrcatA lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrcpynW lstrlenW GetLastError SetLastError VirtualProtect VirtualQuery GetModuleHandleW GetCurrentProcess lstrcmpiA GetModuleHandleA GetProcAddress lstrlenA RtlZeroMemory SetFileTime SizeofResource Sleep UnmapViewOfFile VirtualAllocEx WideCharToMultiByte ExitProcess WriteProcessMemory LocalAlloc LocalFree WaitForSingleObject SetEvent GetPrivateProfileStringA GetPrivateProfileIntA SetFilePointer WriteFile SetEndOfFile FlushFileBuffers CreateEventA CreateFileA GetFileSize ReadFile CloseHandle SuspendThread ResumeThread GetThreadContext GetStdHandle SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree VirtualProtectEx VirtualQueryEx TerminateProcess CreateProcessA ReadProcessMemory GetProcessHeap HeapAlloc HeapFree

Name

.text

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

resc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d9407b3fa27b7b09dadc9214ce253c7802bb5d5aa3157d66ddba7f7218d15d3d

msvcrt

user32

ole32

oleaut32

advapi32

oleacc

shell32

gdiplus

shlwapi

gdi32

kernel32

generic