46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f

Sharing

Copy URL Twitter E-mail

General

Target
46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f
Size 1.1MB
Sample260907-qk2ehsxfnf
SHA256 46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f
MD5 fdb1a98897971ce10fccc85d03a7875b
SHA1 25f96efdf1d4d1d44b12f158c8c867b4cc568eba
SHA512 38765916590f8c3e529cbd72b6b416db8fe54902ed27b2429dd29b07b43fbcb893d2ae667b982f9d0a8e2ddd8b08c3f091ffbbdc0916ed8b281df7df647e301e
SSDEEP 24576:vA+LOyMEXK4w58Qq5kygTAmrRyUjJc6Jw19IgmF8:vj7Kq5N8pIKJc6k9I/F8
TLSH
T16C357C117642C13AD97D12B0593CBBAE507CBE640B6545C7A7D82F6EAD300C3AB36E27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f

File Explorer

46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f

.dll 1.1MB

46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f

IMPHASH e973f94cc6c4242265636bb68f9cf65b
SHA256 46cdd9b34678ac8d79c0838fc50b63f04dacab094d1068e6460b7a875c727a8f
MD5 fdb1a98897971ce10fccc85d03a7875b
SHA1 25f96efdf1d4d1d44b12f158c8c867b4cc568eba
SHA512 38765916590f8c3e529cbd72b6b416db8fe54902ed27b2429dd29b07b43fbcb893d2ae667b982f9d0a8e2ddd8b08c3f091ffbbdc0916ed8b281df7df647e301e
SSDEEP 24576:vA+LOyMEXK4w58Qq5kygTAmrRyUjJc6Jw19IgmF8:vj7Kq5N8pIKJc6k9I/F8
TLSH
T16C357C117642C13AD97D12B0593CBBAE507CBE640B6545C7A7D82F6EAD300C3AB36E27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

235222

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TryEnterCriticalSection DuplicateHandle CreateTimerQueue LoadLibraryExA SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber FlushInstructionCache SignalObjectAndWait IsDebuggerPresent OutputDebugStringW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte GetStringTypeW FormatMessageW EncodePointer CreateEventW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle InitializeCriticalSectionEx ReleaseMutex WaitForSingleObject CreateMutexW FindResourceExW LoadResource LockResource SizeofResource FindResourceW LocalFree DeleteFileW GetTempFileNameW SetEvent GetLocalTime WritePrivateProfileStringW MoveFileW MoveFileExW VerSetConditionMask Sleep LoadLibraryExW lstrcmpiW VerifyVersionInfoW WaitForMultipleObjects ResetEvent GetTickCount64 FindClose FindFirstFileW FindNextFileW GetProcessAffinityMask GetFullPathNameW RemoveDirectoryW SetFileAttributesW GetTempPathW GetWindowsDirectoryW lstrlenW GetLogicalDriveStringsW GetLongPathNameW QueryDosDeviceW GetExitCodeProcess OpenProcess CreateFileW GetSystemInfo CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateDirectoryW GetPrivateProfileStringW GetShortPathNameW GetDriveTypeW GetFileSizeEx GetDiskFreeSpaceExW WriteFile GetFileAttributesExW SetFilePointer SetFileTime ReadFile SetEndOfFile GetStdHandle GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualFree VirtualAlloc ReleaseSemaphore CreateSemaphoreW RtlUnwind InterlockedPushEntrySList InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA GetFileType SetFilePointerEx GetConsoleCP GetConsoleMode GetTimeZoneInformation CreateThread ExitThread FreeLibraryAndExitThread WriteConsoleW GetCurrentThread IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExA FindNextFileA IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle ReadConsoleW FlushFileBuffers WaitForSingleObjectEx DeviceIoControl lstrcmpA SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetModuleHandleA GetVersionExW VirtualProtect QueryDepthSList UnregisterWaitEx InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc InterlockedPopEntrySList HeapAlloc HeapDestroy RaiseException DecodePointer MultiByteToWideChar LoadLibraryW GetProcAddress GetModuleFileNameW FreeLibrary DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError GetFileAttributesW GetLastError

user32

SendMessageW PeekMessageW DispatchMessageW CallWindowProcW DefWindowProcW RegisterClassExW UnregisterClassW GetClassInfoExW CreateWindowExW PostMessageW GetMessageW IsWindow DestroyWindow ShowWindow UpdateLayeredWindow SetWindowPos PostQuitMessage IsWindowVisible IsIconic BringWindowToTop CharNextW GetAsyncKeyState SetCapture ReleaseCapture SetTimer KillTimer SetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint SetWindowTextW DrawFocusRect SetCursor PtInRect EqualRect UnionRect OffsetRect GetClientRect CopyRect CharLowerW CharUpperW FindWindowExW FindWindowW SendNotifyMessageW SendMessageTimeoutW RegisterWindowMessageW GetMonitorInfoW MonitorFromWindow LoadCursorW GetWindow GetParent SetWindowLongW GetWindowLongW MapWindowPoints ScreenToClient GetWindowRect TranslateMessage wsprintfW

oleaut32

SysAllocStringLen VariantInit SysFreeString VarUI4FromStr SysAllocString VariantClear VariantCopy SysAllocStringByteLen SysStringLen

shlwapi

StrTrimA PathIsDirectoryW PathAppendW StrStrIA PathFindExtensionW StrCmpNIW SHCreateStreamOnFileEx StrCmpIW StrToInt64ExW PathIsRelativeW SHSetValueW PathRemoveFileSpecW PathFileExistsW PathCombineW SHGetValueW PathFindFileNameW SHDeleteValueW StrStrIW

comctl32

_TrackMouseEvent InitCommonControlsEx

urlmon

URLDownloadToFileW URLDownloadToCacheFileW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

psapi

GetModuleFileNameExW EnumProcesses GetProcessImageFileNameW

gdiplus

GdipDeleteGraphics GdipFillRectangleI GdipDrawImageRectRect GdipGetImageHeight GdipCreateFromHDC GdipGetImageWidth GdipCreateSolidFill GdipDeleteBrush GdiplusShutdown GdiplusStartup

winhttp

WinHttpReceiveResponse WinHttpSetCredentials WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpQueryHeaders

secur32

GetUserNameExW

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

gdi32

GetDeviceCaps SetViewportOrgEx CreateCompatibleBitmap RectVisible OffsetViewportOrgEx GetObjectW CreateDIBSection SelectObject SelectClipRgn SaveDC RestoreDC DeleteObject DeleteDC CreateRectRgnIndirect CreateCompatibleDC BitBlt

advapi32

RegGetValueW GetTokenInformation FreeSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW

shell32

SHCreateDirectoryExW SHGetSpecialFolderPathW ShellExecuteExW SHChangeNotify ord165

ole32

CoTaskMemAlloc CoCreateInstance CoUninitialize CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoInitialize CoInitializeSecurity

generic

count=1, id=208, version=65501,

count=10, id=261, productName=VS2017 v15.9.11 build 27030, version=27030,

count=2, id=260, version=27034,

count=19, id=241, version=40116,

count=176, id=243, version=40116,

count=32, id=242, version=40116,

count=76, id=265, version=27053,

count=24, id=261, version=27051,

count=3, id=199, version=41118,

count=36, id=260, version=26706,

count=25, id=259, version=26706,

count=127, id=261, version=26706,

count=3, id=206, version=65501,

count=39, id=203, version=65501,

count=443, id=1, productName=Unmarked objects,

count=52, id=261, version=27053,

count=1, id=256, version=27053,

count=1, id=255, version=27053,

count=1, id=151,

count=1, id=258, version=27053,