d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610

Sharing

Copy URL Twitter E-mail

General

Target
d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610
Size 224KB
Sample260907-tebtfszfpc
SHA256 d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610
MD5 c4b85571e0193a87ea12b29e0a4cefa3
SHA1 f72303cc77ae1f031a614c0febc67029a16c220a
SHA512 8d01b00dfaca1b56a586248be92ec68f96048eaa05deac970ac6f65b62d8e635028cc000f78271977b01b8a230f3d3bad83e1d23b65eb97d99929f1b695f2706
SSDEEP 3072:Q896RKK/Xxq7ZlDBgeiJ6JW9JeBlmzT6W/ao1AiJ0fE2:XkHFd9kGzqiJ0fE
TLSH
T10224B45073EA5A15F6B747306CFD62256A367D226B73C6CF6700212C1EB27E1AE74322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610

File Explorer

d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610

.dll 224KB

d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610

IMPHASH a0d52830c1f9f5fd42a41eac92b791f9
SHA256 d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610
MD5 c4b85571e0193a87ea12b29e0a4cefa3
SHA1 f72303cc77ae1f031a614c0febc67029a16c220a
SHA512 8d01b00dfaca1b56a586248be92ec68f96048eaa05deac970ac6f65b62d8e635028cc000f78271977b01b8a230f3d3bad83e1d23b65eb97d99929f1b695f2706
SSDEEP 3072:Q896RKK/Xxq7ZlDBgeiJ6JW9JeBlmzT6W/ao1AiJ0fE2:XkHFd9kGzqiJ0fE
TLSH
T10224B45073EA5A15F6B747306CFD62256A367D226B73C6CF6700212C1EB27E1AE74322
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VariantClear VariantInit

ole32

CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CreateStreamOnHGlobal HMENU_UserFree HMENU_UserMarshal HMENU_UserSize HMENU_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal

user32

ChildWindowFromPointEx ClientToScreen GetAncestor GetClientRect GetGUIThreadInfo GetWindow GetWindowLongW GetWindowThreadProcessId IsChild IsWindow IsWindowVisible LoadStringA LoadStringW MapWindowPoints RealGetWindowClassW ScreenToClient SendMessageW WindowFromPoint

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsicmp calloc free fwrite getenv memcmp memcpy memmove strchr strcmp strcpy strcspn strlen wcslen wcstoul

kernel32

CloseHandle CreateFileMappingW DisableThreadLibraryCalls DuplicateHandle EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFree GlobalGetAtomNameW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MapViewOfFile MultiByteToWideChar OpenProcess RaiseException SizeofResource UnmapViewOfFile WideCharToMultiByte

ntdll

_vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

d97a3bdffb9641193ce64335eeeaf22b193d114d97ad2cebda5bb9edce5e6610

oleaut32

ole32

user32

rpcrt4

ucrtbase

kernel32

ntdll

generic