a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2

Sharing

Copy URL Twitter E-mail

General

Target
a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2
Size 17.1MB
Sample260910-316qdsxfpb
SHA256 a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2
MD5 04b05c8ffd76a0e2be304ad14401428f
SHA1 4b28bfd1f73bdc3b9314230b34ca845531508bfa
SHA512 e4e037bad567925979375d844242a039d9ec5943889e80ef939b5c89969f57e73f5c68aac5ce62353480908487b75e14cebf7212eb736830a7118c44f3f7144c
SSDEEP 393216:uFR9O3FwcykitEscwyXM9MOKkFhJydbtO:uFRE3FwcetEsHiob
TLSH
T1C3075AE115D781C9C559C1798182A72BB27B7B270335AB8F727C61F69E12F822937B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
sample	embeds_openssl

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2

File Explorer

a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2

.exe 17.1MB

a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2

IMPHASH cac91e899d3390d30d1cdcf464ca601b
SHA256 a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2
MD5 04b05c8ffd76a0e2be304ad14401428f
SHA1 4b28bfd1f73bdc3b9314230b34ca845531508bfa
SHA512 e4e037bad567925979375d844242a039d9ec5943889e80ef939b5c89969f57e73f5c68aac5ce62353480908487b75e14cebf7212eb736830a7118c44f3f7144c
SSDEEP 393216:uFR9O3FwcykitEscwyXM9MOKkFhJydbtO:uFRE3FwcetEsHiob
TLSH
T1C3075AE115D781C9C559C1798182A72BB27B7B270335AB8F727C61F69E12F822937B0C
MD5 SHA1 SHA512 SSDEEP TLSH

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14576044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Documents\GitHub\web\loader\binary\Production\loader.pdb

ws2_32

WSACleanup WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons __WSAFDIsSet accept bind WSAIoctl closesocket WSASend select ntohl listen WSASetLastError getsockopt WSARecv WSAAddressToStringW connect ntohs getsockname getpeername getaddrinfo WSASocketW recv send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents socket gethostbyname inet_addr inet_ntoa gethostbyaddr getservbyport getservbyname shutdown recvfrom sendto htonl WSAStartup

iphlpapi

GetAdaptersInfo

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoInitialize CoCreateInstance CoUninitialize

kernel32

TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32Next CloseHandle GetSystemTime EnterCriticalSection WaitForMultipleObjects LeaveCriticalSection WaitForSingleObject PostQueuedCompletionStatus FormatMessageW SetEvent TerminateThread QueueUserAPC LocalFree GetModuleFileNameA DeleteFileA CreateProcessA GetSystemFirmwareTable HeapFree DeviceIoControl GetComputerNameExW CreateFileA HeapAlloc GetProcessHeap GlobalMemoryStatusEx WriteProcessMemory VirtualAlloc ResumeThread GetThreadContext GetThreadId ReadProcessMemory GetModuleHandleW SetThreadContext GetCommandLineA ExitProcess ReadFile SetWaitableTimer SetLastError InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus CreateEventW GetSystemDirectoryA CreateWaitableTimerA GetFileSize SleepEx GetSystemTimeAsFileTime CreateIoCompletionPort Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection VirtualFree InitializeCriticalSection Process32NextW Process32FirstW CreateProcessW GetExitCodeProcess GetModuleFileNameW GetFileAttributesW CreateActCtxW GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW GetNativeSystemInfo DuplicateHandle GetCurrentThread ResetEvent GetTickCount Thread32Next Thread32First CreateNamedPipeW CreateThread GetCurrentProcess GetExitCodeThread GetProcessId IsWow64Process FormatMessageA VirtualAllocEx VirtualFreeEx VirtualProtectEx CreateRemoteThread VirtualQueryEx SuspendThread GetThreadTimes OpenThread GetOEMCP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP CreateDirectoryA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx SetStdHandle FreeLibraryAndExitThread ExitThread SetConsoleCtrlHandler FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW LoadLibraryExW RtlUnwind RtlUnwindEx OutputDebugStringW GetCPInfo GetCurrentThreadId GetCurrentProcessId GetConsoleMode Sleep VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetLocaleInfoA GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar LCMapStringEx EncodePointer GetStringTypeW GetDynamicTimeZoneInformation WriteFile RaiseException CreateSymbolicLinkW GetCommandLineW Process32First GetFileInformationByHandleEx CreateHardLinkW CopyFileW AreFileApisANSI SetFileInformationByHandle GetFullPathNameW DeleteCriticalSection GetFileInformationByHandle GetFileAttributesExW FindFirstFileExW CreateDirectoryW GetLocaleInfoEx WriteConsoleA GetStdHandle SetConsoleTextAttribute GetSystemInfo GetConsoleScreenBufferInfo WaitForSingleObjectEx TryAcquireSRWLockExclusive WakeConditionVariable InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable FindNextFileW FindFirstFileW SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindClose ReadConsoleW ReadConsoleA SetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread SystemTimeToFileTime CreateFiberEx DeleteFiber SwitchToFiber CreateSemaphoreA GetACP VirtualProtect GetModuleHandleExW TlsFree TlsSetValue TlsGetValue DecodePointer LoadLibraryW GetFileAttributesA GetLastError GetTempPathA InitializeCriticalSectionEx QueryPerformanceCounter FlushFileBuffers FreeLibrary TlsAlloc AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock GetFileType WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState CreateSemaphoreW ReleaseSemaphore WriteConsoleW CreateEventA SetUnhandledExceptionFilter

user32

UpdateWindow GetDpiForSystem RegisterClassExA SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture IsWindowUnicode SetProcessDPIAware GetClientRect PostQuitMessage SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetProcessWindowStation GetUserObjectInformationW GetCapture ScreenToClient MonitorFromWindow LoadCursorA GetMonitorInfoA CreateWindowExA GetMessageExtraInfo GetKeyState UnregisterClassA MessageBoxW DefWindowProcA wsprintfW MessageBoxA DestroyWindow GetSystemMetrics SetWindowLongA SetCursor EnumDisplayDevicesW GetWindowRect ShowWindow PostMessageA SetWindowPos PeekMessageA TranslateMessage MoveWindow DispatchMessageA

gdi32

DeleteObject CreateRectRgn

advapi32

OpenServiceA CryptGenRandom CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource LookupPrivilegeValueW RegOpenKeyExW OpenThreadToken RegQueryValueExW RegSetValueExW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyW RegEnumValueW RevertToSelf PrivilegeCheck SetTokenInformation SetThreadToken DuplicateTokenEx CreateProcessAsUserA ConvertSidToStringSidW GetUserNameW RegEnumValueA RegDeleteValueA RegEnumKeyExA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken GetTokenInformation QueryServiceStatus CloseServiceHandle OpenSCManagerA CryptAcquireContextA RegDeleteTreeA RegCloseKey RegDeleteKeyA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegOpenKeyExA

shell32

ShellExecuteExA ShellExecuteW ShellExecuteA

oleaut32

SysFreeString

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

shlwapi

SHDeleteKeyW

urlmon

URLDownloadToFileA

ntdll

RtlAnsiStringToUnicodeString RtlPcToFileHeader RtlLookupFunctionEntry RtlFreeUnicodeString RtlInitAnsiString RtlNtStatusToDosError RtlCaptureContext RtlVirtualUnwind

crypt32

CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenStore CertOpenSystemStoreW

wininet

InternetOpenW InternetConnectW InternetReadFile InternetQueryDataAvailable InternetCloseHandle InternetCrackUrlW InternetSetOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

74KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

213KB

Virtual Size

212KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a71252457565cdb9d490d0cfed81a41efc32935be8063ee6de23eee98857c5b2

ws2_32

iphlpapi

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

advapi32

shell32

oleaut32

imm32

dwmapi

shlwapi

urlmon

ntdll

crypt32

wininet

generic