444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17

Sharing

Copy URL Twitter E-mail

General

Target
444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17
Size 1.1MB
Sample260906-151c3ateja
SHA256 444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17
MD5 71425ebda3d54d60dc82f85c056e7796
SHA1 87177c05be1470bdd38fa77f1a9046493d325cb6
SHA512 d9b38d04a73bc339ffa2bc27ddb8d245bc05cad8a8d649d204b90e870e69deea3707ab40e42956f9f08417602f25138b715b7bcb3af14b8976d36bdf4fa07806
SSDEEP 6144:uNaORHxc0YQC/8tUDdwxvFzStPfcQdbCYudwk5lTkvGHQ07g:uNTRHrYQPtU+xvF+tFRuNWig
TLSH
T15E45E62167F88512F2F39B341CB292502E767E519B35CB7F924066DD0B33B829DA1B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17

File Explorer

444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17

.exe 1.1MB

444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17

IMPHASH bdedad6dc854a3e8e3c6759357cfa470
SHA256 444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17
MD5 71425ebda3d54d60dc82f85c056e7796
SHA1 87177c05be1470bdd38fa77f1a9046493d325cb6
SHA512 d9b38d04a73bc339ffa2bc27ddb8d245bc05cad8a8d649d204b90e870e69deea3707ab40e42956f9f08417602f25138b715b7bcb3af14b8976d36bdf4fa07806
SSDEEP 6144:uNaORHxc0YQC/8tUDdwxvFzStPfcQdbCYudwk5lTkvGHQ07g:uNTRHrYQPtU+xvF+tFRuNWig
TLSH
T15E45E62167F88512F2F39B341CB292502E767E519B35CB7F924066DD0B33B829DA1B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79504

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControls ord320 ord323 ord324 ord388 PropertySheetW

comdlg32

ChooseColorW ChooseFontW GetOpenFileNameW

gdi32

CreateFontIndirectW CreateFontW CreateSolidBrush DeleteObject GetDeviceCaps GetObjectW SetBkColor SetTextColor

kernel32

CloseHandle CreateFileW CreateProcessW DeviceIoControl ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageA GetCommandLineW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetStartupInfoW GetTickCount GetVolumeInformationW GlobalGetAtomNameW HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsWow64Process MulDiv MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency SetVolumeLabelW WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpiW

ntdll

RtlDosPathNameToNtPathName_U RtlFreeUnicodeString _vsnprintf

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

shell32

ord155 ord195 SHBindToParent SHBrowseForFolderW SHCreateDirectoryExW SHFileOperationW SHGetDesktopFolder SHGetFolderLocation SHGetFolderPathW ShellExecuteW

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveExtensionW StrRetToBufW StrRetToStrW

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _assert _configure_wide_argv _get_initial_wide_environment _initialize_wide_environment _set_app_type _strdup _wcsdup _wcsicmp bsearch exit free fwrite getenv malloc memcmp memcpy memmove realloc setlocale strchr strcmp strcpy strcspn strlen strrchr toupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstol wcstoul

user32

AdjustWindowRectEx CheckDlgButton CheckRadioButton DestroyIcon DialogBoxParamW DrawEdge DrawFocusRect DrawFrameControl DrawIconEx EnableWindow EndDialog EnumWindows FillRect FrameRect GetClientRect GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemInt GetDpiForWindow GetMenu GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindowLongW GetWindowTextLengthW GetWindowTextW InvalidateRect IsDlgButtonChecked KillTimer LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxIndirectW MessageBoxW MoveWindow ReleaseDC SendDlgItemMessageW SendMessageW SetCursor SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetFocus SetSysColors SetTimer SetWindowLongW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow SystemParametersInfoW

uxtheme

ord2 ord3 ord4 ord8 ord9 ord10 CloseThemeData DrawThemeBackground DrawThemeParentBackground GetCurrentThemeName GetThemeMargins IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeDataForDpi

winmm

PlaySoundW

Name

.text

Size

76KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

648KB

Virtual Size

644KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

703B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/83

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/99

Size

4KB

Virtual Size

63B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

444ef3bc1568764457d1f0f31e5a8cad53397ba05da2f40762b0ba8a7b235f17

advapi32

comctl32

comdlg32

gdi32

kernel32

ntdll

ole32

shell32

shlwapi

ucrtbase

user32

uxtheme

winmm

generic