d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e

Sharing

Copy URL Twitter E-mail

General

Target
d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e
Size 472KB
Sample260907-v6w45sdn21
SHA256 d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e
MD5 88f01146d9648271cb04f3d73b132ff1
SHA1 7f549d23683beb485d04e2d38c12f1930380f370
SHA512 f1342133fd7618879103051207401ae3ad40d9187bc380213497edd1b236aa80f70ce3c0730de436589e7dd8955c36f03d1368b785d49fa5494a0cc3b133d895
SSDEEP 12288:J2b5Zv0kuNW8RDw0ixPj+qv1LilQWfV6qmmYm4:J2bORpixPj+qvQlrXmmYF
TLSH
T171A49E1176B1C032D4A281314E79EBA5627EFD710FA259CFB3D46A2D2B705C26B35B13
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e

File Explorer

d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e

.exe 472KB

d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e

IMPHASH 4f30d4a53981b3bde0fd2dfc6852a3cf
SHA256 d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e
MD5 88f01146d9648271cb04f3d73b132ff1
SHA1 7f549d23683beb485d04e2d38c12f1930380f370
SHA512 f1342133fd7618879103051207401ae3ad40d9187bc380213497edd1b236aa80f70ce3c0730de436589e7dd8955c36f03d1368b785d49fa5494a0cc3b133d895
SSDEEP 12288:J2b5Zv0kuNW8RDw0ixPj+qv1LilQWfV6qmmYm4:J2bORpixPj+qvQlrXmmYF
TLSH
T171A49E1176B1C032D4A281314E79EBA5627EFD710FA259CFB3D46A2D2B705C26B35B13
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

211781

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

rpcrt4

RpcServerInqCallAttributesW NdrCStdStubBuffer2_Release NdrStubForwardingFunction IUnknown_Release_Proxy NdrOleFree NdrStubCall2 IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy NdrOleAllocate

kernel32

GetLocalTime OpenProcess QueryFullProcessImageNameW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetShortPathNameW RemoveDirectoryW CopyFileW MoveFileExW ProcessIdToSessionId FindResourceExW LockResource CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueTimer DeleteTimerQueueEx OpenMutexW GetCurrentProcessId CreateProcessW GetTickCount GetWindowsDirectoryW WritePrivateProfileStringW CreateFileW ReadFile GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation LocalFree ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType WriteFile GetStdHandle ExitProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionAndSpinCount LocalAlloc GetVersionExW GetCurrentThreadId GetCurrentThread CreateThread GetCurrentProcess Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent RaiseException CloseHandle OutputDebugStringW GetCommandLineW MultiByteToWideChar lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError DecodePointer GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle SetEndOfFile WriteConsoleW SetLastError RtlUnwind InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetCPInfo CompareStringEx GetFileSizeEx GetStringTypeW WideCharToMultiByte InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter GetLocaleInfoEx EncodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive

user32

DispatchMessageW MessageBoxW PostThreadMessageW CharUpperW TranslateMessage LoadStringW CharNextW GetMessageW

shell32

SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW ord680 SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoTaskMemFree CoReleaseServerProcess CoInitializeSecurity CoCreateInstance StringFromGUID2 CoCreateGuid CoAddRefServerProcess CoTaskMemAlloc CoTaskMemRealloc

oleaut32

BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize UnRegisterTypeLi RegisterTypeLi SysAllocString LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen VariantClear SysFreeString

advapi32

SetSecurityDescriptorGroup RegCreateKeyExW RegDeleteKeyW SetTokenInformation RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx CreateProcessAsUserW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW FreeSid EqualSid AllocateAndInitializeSid ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle RegQueryValueExW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorSacl SetSecurityDescriptorOwner SetSecurityDescriptorDacl IsValidSid InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetSecurityDescriptorSacl GetLengthSid CopySid AddAccessAllowedAce OpenThreadToken OpenProcessToken RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCloseKey

shlwapi

PathFileExistsW PathFindFileNameW PathAppendW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvSignerFromChain WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WinVerifyTrust

Name

.text

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d3cc3f2f07bf33e97deabb077d5ec699e45b2117b4dbd067a96d9a78abb44b9e

rpcrt4

kernel32

user32

shell32

ole32

oleaut32

advapi32

shlwapi

version

wtsapi32

userenv

crypt32

wintrust

generic