06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4

Sharing

Copy URL Twitter E-mail

General

Target
06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4
Size 9.4MB
Sample260908-sptxcatamd
SHA256 06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4
MD5 0f33737c16e0f88562ffa4966f6856b7
SHA1 db2463ba587b5b90b3158d741bb76cb0a750bc61
SHA512 3687537202869d725395597c834950bba157d70047362adb6b047bbc7ccfda127d7501360a5632db70c7b31778b9c291fac1ee9544c585e434d4af78fa4e6a43
SSDEEP 3072:QBKNrO8U+Zyh3PEuiYRoGQfGW+p7iWT1BGjOMilIopzqtcpLchRvKVP:Qmmh3RiYVQX+pOWG6NzKLsP
TLSH
T17EA69E02F2D650BAF4B6153008BA1B359ABDBD018E25DA97AB34FD1E5D31742E83D34E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4

File Explorer

06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4

.exe 9.4MB

06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4

IMPHASH 48ea307be18ed25a1d68f296f0591a5c
SHA256 06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4
MD5 0f33737c16e0f88562ffa4966f6856b7
SHA1 db2463ba587b5b90b3158d741bb76cb0a750bc61
SHA512 3687537202869d725395597c834950bba157d70047362adb6b047bbc7ccfda127d7501360a5632db70c7b31778b9c291fac1ee9544c585e434d4af78fa4e6a43
SSDEEP 3072:QBKNrO8U+Zyh3PEuiYRoGQfGW+p7iWT1BGjOMilIopzqtcpLchRvKVP:Qmmh3RiYVQX+pOWG6NzKLsP
TLSH
T17EA69E02F2D650BAF4B6153008BA1B359ABDBD018E25DA97AB34FD1E5D31742E83D34E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9707251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

GetDateFormatW FileTimeToSystemTime FileTimeToLocalFileTime CompareFileTime FindClose FindNextFileW FindFirstFileW SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation TerminateProcess CreateProcessW GetDriveTypeW GetLogicalDrives CreateThread ResetEvent OpenEventW SetEvent LoadLibraryW CreateEventW InitializeCriticalSection GetFullPathNameW GetSystemDirectoryW WaitForMultipleObjects GetTempPathW GetCommandLineW GetModuleFileNameW FlushFileBuffers CompareStringW CompareStringA SetConsoleCtrlHandler SetEndOfFile IsBadCodePtr SetUnhandledExceptionFilter SetStdHandle GetStringTypeW GetStringTypeA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage MapViewOfFile GetCPInfo GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCommandLineA GetEnvironmentStrings GetTimeFormatW FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapSize GetCurrentThread TlsGetValue TlsFree TlsAlloc TlsSetValue GetCurrentThreadId HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA GetModuleFileNameA IsBadWritePtr VirtualAlloc VirtualFree LCMapStringW LCMapStringA FatalAppExitA DeleteCriticalSection ExitProcess GetVersion GetStartupInfoW GetModuleHandleA WideCharToMultiByte RtlUnwind HeapFree HeapAlloc HeapReAlloc LoadLibraryA GetLocaleInfoW GlobalAlloc GlobalLock GlobalUnlock GetFileAttributesW lstrlenA InterlockedExchange GetFileSize UnmapViewOfFile GetTickCount lstrlenW VirtualProtect IsBadReadPtr GetCurrentDirectoryW DeviceIoControl OpenProcess ReadProcessMemory SetFileAttributesW DeleteFileW CopyFileW InterlockedIncrement InterlockedDecrement WaitForSingleObject LocalFree FormatMessageW Sleep DebugBreak ReadFile GetEnvironmentStringsW CreateFileMappingW EnterCriticalSection LeaveCriticalSection WriteFile MultiByteToWideChar DosDateTimeToFileTime LocalFileTimeToFileTime GetModuleHandleW GetProcAddress SetLastError CreateFileW FindResourceW LoadResource SizeofResource LockResource GetCurrentProcess CloseHandle GetVersionExW CreateFileA SetFilePointer GetLastError GetACP GetOEMCP SetEnvironmentVariableA IsValidLocale RaiseException

user32

OffsetRect GetClientRect EndDeferWindowPos EnumChildWindows BeginDeferWindowPos UnionRect BeginPaint EndPaint DrawFrameControl CreateDialogParamW SetWindowPlacement DeferWindowPos GetClassNameW ScreenToClient DrawTextW CallWindowProcW PtInRect IsZoomed GetPropW UpdateWindow LoadAcceleratorsW GetMessageW TranslateAcceleratorW IsDialogMessageW TranslateMessage GetWindowTextW SetPropW GetWindowLongW SetWindowLongW SetFocus GetMenu CheckMenuItem GetWindowPlacement GetDlgItemTextW SetTimer EnableWindow DialogBoxParamW KillTimer DefWindowProcW MsgWaitForMultipleObjects LoadIconW SetWindowTextW DestroyIcon PostQuitMessage SetDlgItemTextW IsWindowEnabled CheckDlgButton IsDlgButtonChecked RegisterClassExW ShowWindow MapWindowPoints CreateWindowExW SetCapture ReleaseCapture EndDialog GetParent GetWindowRect MoveWindow GetDlgItem LoadCursorW GetSysColorBrush GetSysColor ChildWindowFromPoint InvalidateRect SetCursor OpenClipboard EmptyClipboard SetClipboardData CloseClipboard LoadStringW SendMessageW PostMessageW MessageBoxW wsprintfW DispatchMessageW GetSystemMetrics

gdi32

SetBkMode CreateFontIndirectW GetObjectW SelectObject SetTextColor GetStockObject

comdlg32

GetSaveFileNameW

advapi32

QueryServiceStatus CloseServiceHandle IsValidSecurityDescriptor RegGetKeySecurity RegQueryValueExW RegQueryInfoKeyW RegEnumValueW GetSecurityDescriptorLength MakeAbsoluteSD MakeSelfRelativeSD RegOpenKeyExW RegQueryValueW RegConnectRegistryW RegEnumKeyExW RegCreateKeyExW RegCreateKeyW RegSetValueExW RegCloseKey RegDeleteKeyW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegQueryValueExA RegOpenKeyExA ControlService OpenServiceW OpenSCManagerW StartServiceW CreateServiceW SetServiceStatus RegEnumKeyW RegDeleteValueW FreeSid EqualSid GetTokenInformation AllocateAndInitializeSid RegisterServiceCtrlHandlerW StartServiceCtrlDispatcherW DeleteService

shell32

ExtractIconExW CommandLineToArgvW ShellExecuteW

ole32

CreateBindCtx

oleaut32

SetErrorInfo GetErrorInfo CreateErrorInfo VariantChangeType VariantInit VariantClear VariantTimeToSystemTime SysAllocStringByteLen SysAllocString SysFreeString SysStringLen

comctl32

ImageList_Create ImageList_ReplaceIcon PropertySheetW ord17

mpr

WNetEnumResourceW WNetOpenEnumW WNetCloseEnum

psapi

GetModuleBaseNameW EnumProcessModules EnumProcesses

Name

.text

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.khe

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

06dfade608793a2fceef56e26e63be820d049ce64cbb80ec324dbbbf79dc56f4

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

mpr

psapi

generic