3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94.exe
Size 23.5MB
Sample260908-qstdwa1epd
SHA256 3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94
MD5 fe861c24d40347b837a7b57b56d3d4f6
SHA1 bffabbb1dfc9b60f697157737a9c0398e9b2f90d
SHA512 b178525d03326ac048f052379f4abab215ab7ca975ad41544a9feee17fd07a94c28344ad773c8e98c9b8d985e94284b3196b196aaa15f74696b4c9b0a232a25d
SSDEEP 393216:RVvOIcdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoV:RVvBcdclNJNfSpzAn
TLSH
T17D470186A2C64717DF92BD3EF1119253E562FCD6221146D35F8E0F2ADB0AAF0847DE18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94.exe

File Explorer

3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94.exe

.dll 23.5MB

3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94.exe

IMPHASH 3f6555c2fd0de5690eb8f87ec1d726a8
SHA256 3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94
MD5 fe861c24d40347b837a7b57b56d3d4f6
SHA1 bffabbb1dfc9b60f697157737a9c0398e9b2f90d
SHA512 b178525d03326ac048f052379f4abab215ab7ca975ad41544a9feee17fd07a94c28344ad773c8e98c9b8d985e94284b3196b196aaa15f74696b4c9b0a232a25d
SSDEEP 393216:RVvOIcdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoV:RVvBcdclNJNfSpzAn
TLSH
T17D470186A2C64717DF92BD3EF1119253E562FCD6221146D35F8E0F2ADB0AAF0847DE18
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1030664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Ad\Downloads\ff\x64\Release\menu.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

dxgi

CreateDXGIFactory

d3dcompiler_43

D3DCompile

shell32

SHGetFolderPathA

ws2_32

recv htonl inet_ntop htons setsockopt socket send WSAStartup accept bind closesocket select listen

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

wininet

InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile InternetOpenUrlA HttpOpenRequestA

bcrypt

BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDestroyKey

crypt32

CryptUnprotectData CryptStringToBinaryA

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleFileNameW CompareStringW LCMapStringW GetLocaleInfoW GetTickCount64 WideCharToMultiByte GetTickCount MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter VirtualFree VirtualAlloc GetSystemInfo VirtualQuery HeapCreate VirtualProtect HeapFree GetCurrentProcess Thread32Next Thread32First GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot Sleep GetLastError HeapReAlloc CloseHandle HeapAlloc GetThreadContext GetCurrentProcessId GetModuleHandleW FlushInstructionCache SetThreadContext OpenThread WriteProcessMemory OpenProcess Process32NextW DisableThreadLibraryCalls Process32FirstW CreateThread Module32FirstW VirtualProtectEx Module32NextW ReadFile WriteFile CreatePipe IsValidLocale GetDateFormatW GetExitCodeProcess TerminateProcess CreateProcessW GetComputerNameA GetEnvironmentVariableA GetVolumeInformationA GetTempPathA CopyFileA DeleteFileA LocalFree GlobalMemoryStatusEx ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InterlockedFlushSList RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DuplicateHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetSystemTimeAsFileTime InitializeCriticalSectionEx WakeAllConditionVariable GetFileInformationByHandleEx CopyFileW AreFileApisANSI ExitProcess GetUserDefaultLCID EnumSystemLocalesW GetTimeFormatW GetStdHandle GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA FreeLibraryAndExitThread GetModuleHandleExW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile WaitForSingleObject RtlUnwind WaitForSingleObjectEx SwitchToThread GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle

user32

IsWindowVisible EnumChildWindows GetClassNameA GetWindowTextA EnumWindows DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow MapWindowPoints MoveWindow DefWindowProcA SetLayeredWindowAttributes GetWindowThreadProcessId DispatchMessageA IsWindow SetWindowDisplayAffinity TranslateMessage mouse_event PeekMessageA UpdateWindow GetWindowLongA GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState GetCursorInfo SetWindowLongA GetKeyState SetWindowPos InvalidateRect

gdi32

DeleteObject BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC SetStretchBltMode

advapi32

CryptGetHashParam RegSetValueExW CryptReleaseContext RegQueryValueExW CryptHashData RegEnumKeyA RegQueryValueExA GetUserNameA RegOpenKeyExA CryptAcquireContextA RegCloseKey CryptCreateHash RegOpenKeyExW RegCreateKeyExW CryptDestroyHash

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmSetCompositionWindow

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.1MB

Virtual Size

22.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3b80c7da6b7f5198660524dfa5e0a7a9e9e1dd94dd351f98c334b06e4cf0fa94.exe

dwmapi

d3d11

d3dx11_43

dxgi

d3dcompiler_43

shell32

ws2_32

iphlpapi

wininet

bcrypt

crypt32

kernel32

user32

gdi32

advapi32

imm32

generic