afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b

Sharing

Copy URL Twitter E-mail

General

Target
afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b
Size 464KB
Sample260907-wdcepsdp41
SHA256 afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b
MD5 b229c7a6e0814d55b93020f91f29aaf1
SHA1 84a353c4fd9d704a46d6380fcfd08f23cfd52867
SHA512 68fab32bcc2ce3d31a3f3d198f3e04b4712d3af366068538bc7cf74e43c08f11976f0d0c2b0846d60cc9be72c3934266f64829ab74534da21773062b6a9d62b4
SSDEEP 6144:Z1AHxerfF0DOOSboFicyXFbRNK/VcYHy:ZqIfefyXFbRNKqG
TLSH
T13AA43A60BAD6AB47D11B83352CF99A12FB35252033AB5BD3A3840D3C4EE57D35D78A06
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b

File Explorer

afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b

.dll 464KB

afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b

IMPHASH eda87dc3ae1c039e92b2ded5e01cbb02
SHA256 afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b
MD5 b229c7a6e0814d55b93020f91f29aaf1
SHA1 84a353c4fd9d704a46d6380fcfd08f23cfd52867
SHA512 68fab32bcc2ce3d31a3f3d198f3e04b4712d3af366068538bc7cf74e43c08f11976f0d0c2b0846d60cc9be72c3934266f64829ab74534da21773062b6a9d62b4
SSDEEP 6144:Z1AHxerfF0DOOSboFicyXFbRNK/VcYHy:ZqIfefyXFbRNKqG
TLSH
T13AA43A60BAD6AB47D11B83352CF99A12FB35252033AB5BD3A3840D3C4EE57D35D78A06
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

110976

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

cfgmgr32

CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_PropertyW

comctl32

InitCommonControls

ole32

CoTaskMemFree StringFromCLSID

user32

CallNextHookEx CharLowerW CharUpperW ClipCursor CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EndDialog GetClientRect GetCursorPos GetDesktopWindow GetDlgItem GetForegroundWindow GetKeyNameTextW GetKeyState GetKeyboardType GetRawInputData GetSystemMetrics GetWindowLongW GetWindowThreadProcessId IsWindow LoadStringW MapVirtualKeyW MapWindowPoints MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterClassExW RegisterRawInputDevices SendDlgItemMessageW SendMessageW SetCursorPos SetThreadDpiAwarenessContext SetWindowLongW SetWindowsHookExW ShowCursor TranslateMessage UnhookWindowsHookEx UnregisterClassW

advapi32

GetUserNameW RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyValueW RegDeleteTreeW RegEnumKeyW RegGetValueW RegOpenKeyA RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

hid

HidD_FreePreparsedData HidD_GetAttributes HidD_GetFeature HidD_GetHidGuid HidD_GetPreparsedData HidD_GetProductString HidD_SetFeature HidP_GetCaps HidP_GetLinkCollectionNodes HidP_GetSpecificButtonCaps HidP_GetSpecificValueCaps HidP_GetUsageValue HidP_GetUsages HidP_GetUsagesEx HidP_InitializeReportForID HidP_MaxUsageListLength HidP_SetUsageValue HidP_SetUsages

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _strdup _wcsnicmp atan2 calloc cos free fwrite getenv malloc memcmp memcpy memmove memset realloc round sin sqrt strchr strcmp strcpy strcspn strlen strrchr wcscmp wcscpy wcslen wcsstr

kernel32

CancelIoEx CloseHandle CreateEventW CreateFileW CreateMutexW CreateProcessW CreateThread DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW FreeLibraryAndExitThread GetEnvironmentVariableW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExA GetModuleHandleW GetOverlappedResult GetProcAddress GetSystemTimeAsFileTime GetTickCount64 GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MulDiv MultiByteToWideChar ReadFile ReleaseMutex SetEvent SetThreadDescription SizeofResource WaitForSingleObject WideCharToMultiByte WriteFile

ntdll

_chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

afcd3f9602620dc3fa90ef86c150299a6b08f092d9b1555f0b03d8c09fc4c72b

cfgmgr32

comctl32

ole32

user32

advapi32

hid

ucrtbase

kernel32

ntdll

generic