e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3

Sharing

Copy URL Twitter E-mail

General

Target
e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3
Size 225KB
Sample260905-db36jadp3t
SHA256 e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3
MD5 9f89ea0f913b09e03f9b39d57e9cd876
SHA1 c22bb71978797b50f979d1674bc4d587f4df306a
SHA512 7941a3185640fde1b6201d9a6054f626e97d9e830a86db765cc5f1bac917cf279aacdb505b2d7c75a156212a307767afdc839e9947b69a653d2a1e24a88cf7a3
SSDEEP 6144:0OpaoC5GHfXgG3DatRrH8k5PVQhN9TBqXUcV:tpao3atj0hN9TE
TLSH
T12634BE11E3204437C4F611BBA4B7A679972CBF625328B4CB66D87E961F341E61E3078B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3

File Explorer

e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3

.dll 225KB

e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3

IMPHASH e967dafc8550d0f848a351ac3575fd79
SHA256 e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3
MD5 9f89ea0f913b09e03f9b39d57e9cd876
SHA1 c22bb71978797b50f979d1674bc4d587f4df306a
SHA512 7941a3185640fde1b6201d9a6054f626e97d9e830a86db765cc5f1bac917cf279aacdb505b2d7c75a156212a307767afdc839e9947b69a653d2a1e24a88cf7a3
SSDEEP 6144:0OpaoC5GHfXgG3DatRrH8k5PVQhN9TBqXUcV:tpao3atj0hN9TE
TLSH
T12634BE11E3204437C4F611BBA4B7A679972CBF625328B4CB66D87E961F341E61E3078B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

malloc ??2@YAPAXI@Z ??3@YAXPAX@Z free _strnicmp memmove realloc sprintf atoi atof rename _ftol strcpy strlen memcpy memset strcmp strtol isxdigit toupper mktime _strcmpi fopen fclose fwrite _onexit __dllonexit _except_handler3 _CxxThrowException wcslen ??1type_info@@UAE@XZ

user32

CallWindowProcA WindowFromDC UpdateWindow UnhookWindowsHookEx TranslateMessage ShowWindow SetWindowsHookExA SetWindowTextW SetWindowTextA SetWindowPos SetWindowLongA SetTimer SetRect SetForegroundWindow SetDlgItemTextA SetCursor SendMessageA SendDlgItemMessageA ScreenToClient ReleaseDC RegisterClassExA PtInRect PostQuitMessage OffsetRect MessageBoxW MessageBoxA LoadImageW LoadImageA LoadIconW LoadIconA LoadCursorA LoadBitmapW LoadBitmapA KillTimer InvalidateRect GetWindowRect GetWindowLongA GetSystemMetrics GetSysColor GetParent GetMessageW GetMessageA GetDlgItemTextW GetDlgItemTextA GetDlgItem GetDlgCtrlID GetDC GetCursorPos GetClientRect FindWindowExA FindWindowA EndDialog EnableWindow DrawTextA DrawIconEx DispatchMessageA DialogBoxParamA DestroyWindow DefWindowProcA CreateWindowExW CreateWindowExA CreateDialogIndirectParamW CallNextHookEx wsprintfA IsWindow EnumChildWindows RegisterWindowMessageA SendMessageTimeoutA GetClassNameA CreateDialogIndirectParamA

ole32

CLSIDFromString CoGetMalloc CoCreateInstance CoUninitialize CreateStreamOnHGlobal GetHGlobalFromStream CoInitialize

oleaut32

SysFreeString OleLoadPicture VariantClear SysAllocString

advapi32

RegSetValueExA RegCreateKeyExA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegEnumKeyExA RegCloseKey

oleacc

ObjectFromLresult

shell32

SHGetFolderPathW ShellExecuteExA

gdiplus

GdipSaveImageToStream GdiplusStartup GdipGetImageEncodersSize GdipGetImageEncoders GdipDisposeImage GdipCreateBitmapFromHBITMAP

shlwapi

PathIsRelativeA PathIsDirectoryA StrToIntExA StrTrimA StrStrIA PathAddBackslashA PathFindFileNameA PathIsRootA PathRemoveBackslashA PathRemoveFileSpecA PathUnquoteSpacesA StrChrA StrStrIW PathAppendW PathFindExtensionA

gdi32

GetPixel GetCurrentObject ExcludeClipRect DeleteObject GetStockObject CreateSolidBrush CreateCompatibleDC BitBlt GetObjectA GetBitmapBits SetBitmapBits CreateFontA PatBlt RoundRect SelectClipRgn SelectObject SetBkMode SetStretchBltMode SetTextColor StretchBlt CreateDIBSection CreateDIBitmap DeleteDC

kernel32

RemoveDirectoryA MultiByteToWideChar MapViewOfFile LockResource LoadResource LoadLibraryA IsBadStringPtrA GlobalUnlock GlobalSize GlobalLock GlobalFree GlobalAlloc GetTempPathA GetSystemTime GetModuleFileNameA GetLocalTime GetFileTime GetCurrentThreadId FreeResource FindResourceA FindNextFileA FindFirstFileA FindClose RtlMoveMemory DeviceIoControl DeleteFileA CreateRemoteThread CreateFileMappingA CreateDirectoryA GetCurrentThread lstrcpyA lstrcatA lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrcpynW lstrlenW GetLastError SetLastError VirtualProtect VirtualQuery GetModuleHandleW GetCurrentProcess lstrcmpiA GetModuleHandleA GetProcAddress lstrlenA RtlZeroMemory SetFileTime SizeofResource Sleep UnmapViewOfFile VirtualAllocEx WideCharToMultiByte ExitProcess WriteProcessMemory LocalAlloc LocalFree WaitForSingleObject SetEvent GetPrivateProfileStringA GetPrivateProfileIntA SetFilePointer WriteFile SetEndOfFile FlushFileBuffers CreateEventA CreateFileA GetFileSize ReadFile CloseHandle SuspendThread ResumeThread GetThreadContext GetStdHandle SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree VirtualProtectEx VirtualQueryEx TerminateProcess CreateProcessA ReadProcessMemory GetProcessHeap HeapAlloc HeapFree

Name

.text

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

resc

Size

512B

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e14bd7a4b40fe8613f0ef63dc76123e821acffd519664ac4aa75405054a03af3

msvcrt

user32

ole32

oleaut32

advapi32

oleacc

shell32

gdiplus

shlwapi

gdi32

kernel32

generic