2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6

Sharing

Copy URL Twitter E-mail

General

Target
2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6
Size 2.8MB
Sample260916-2nv8fs1v3j
SHA256 2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6
MD5 c71d3d8252c3132cbf5289021978ee68
SHA1 2997b7671f22c8c8e1e51a56b2c826514f833b1d
SHA512 8a3f626bb2c27a5decacace68410dba59e78bbae9ec420697ceedfb568cd123c4408c6ce07ff8ca2431dadcc41feb5668c64de4812ffc40c53092cef1559d511
SSDEEP 49152:dFjNmFvmf77ixEuqlJ3FEixyaLXSPhgOcUq+ijFXVr+85s:LRmFvmHLuOdFEiIIX+g5
TLSH
T132D5AF82F7C29261E9D7007901BA9B7F8D39B9245B25DAE3CBC048B65D341D1263E3DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6

File Explorer

2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6

.dll 2.8MB

2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6

IMPHASH ad03e092cee9cebac7e9f3f384fa27e2
SHA256 2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6
MD5 c71d3d8252c3132cbf5289021978ee68
SHA1 2997b7671f22c8c8e1e51a56b2c826514f833b1d
SHA512 8a3f626bb2c27a5decacace68410dba59e78bbae9ec420697ceedfb568cd123c4408c6ce07ff8ca2431dadcc41feb5668c64de4812ffc40c53092cef1559d511
SSDEEP 49152:dFjNmFvmf77ixEuqlJ3FEixyaLXSPhgOcUq+ijFXVr+85s:LRmFvmHLuOdFEiIIX+g5
TLSH
T132D5AF82F7C29261E9D7007901BA9B7F8D39B9245B25DAE3CBC048B65D341D1263E3DE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1560674

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

ws2_32

inet_ntop inet_ntoa closesocket WSASetLastError send recv WSAGetLastError WSACleanup

kernel32

AcquireSRWLockShared ReadFile QueryDosDeviceW GetFileSizeEx VirtualProtect VirtualFree GetCurrentProcess WriteFile K32GetMappedFileNameA SetFilePointer QueryDosDeviceA CreateFileW GetCurrentThreadId UnmapViewOfFile GetModuleHandleA GetCommandLineA GetLogicalDriveStringsW K32GetModuleFileNameExA GetLastError CreateFileA GetVersionExA CloseHandle GetSystemInfo GetLogicalDriveStringsA GetProcAddress CreateFileMappingA GetFileSize GetCurrentProcessId WideCharToMultiByte CreateDirectoryA GetSystemTime K32GetMappedFileNameW MapViewOfFile VirtualQuery DuplicateHandle GetCurrentThread GetThreadContext SetThreadContext OpenThread K32GetProcessImageFileNameA OpenProcess CreateProcessW IsWow64Process VirtualQueryEx OutputDebugStringA FormatMessageA LoadLibraryA MoveFileA GetFullPathNameA SetEndOfFile DeleteFileA CreateToolhelp32Snapshot VirtualProtectEx ReadProcessMemory K32EnumProcessModules InitializeCriticalSectionEx MultiByteToWideChar RaiseException DeleteCriticalSection LoadLibraryExA Module32Next Thread32Next Thread32First Module32First Sleep ReleaseSRWLockShared FreeLibrary IsBadReadPtr GetSystemTimeAsFileTime FindFirstFileA FindNextFileA FindClose HeapCreate GetCommandLineW InitializeCriticalSection SetErrorMode AddVectoredExceptionHandler SetUnhandledExceptionFilter GetModuleHandleW SuspendThread ResumeThread EnterCriticalSection FindNextFileW lstrlenW LeaveCriticalSection GetFileAttributesW GetFileAttributesA ExitThread FileTimeToSystemTime SystemTimeToFileTime GetProcessIdOfThread TryEnterCriticalSection GetVolumeInformationA GetVolumeNameForVolumeMountPointA GetTempPathA GetWindowsDirectoryA CreateEventA GetComputerNameA GetFullPathNameW GetLongPathNameW GetProcessId OpenMutexA LocalFree GetLongPathNameA CallNamedPipeW OpenEventA WaitForSingleObject SetEvent CreateThread ExitProcess HeapDestroy TlsSetValue TlsAlloc TlsGetValue TlsFree QueryPerformanceFrequency QueryPerformanceCounter GetStdHandle GetFileType SwitchToThread InitializeCriticalSectionAndSpinCount GetModuleHandleExW DeleteFiber ConvertFiberToThread LoadLibraryW FindFirstFileW GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW FlsFree FlsSetValue FlsGetValue FlsAlloc SystemTimeToTzSpecificLocalTime AcquireSRWLockExclusive ReleaseSRWLockExclusive EncodePointer GetModuleFileNameW SetLastError InitOnceExecuteOnce HeapAlloc HeapReAlloc HeapFree CompareStringW LCMapStringW HeapSize SetFilePointerEx GetConsoleOutputCP SetStdHandle GetTimeZoneInformation FlushFileBuffers GetCurrentDirectoryW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap DecodePointer CallNamedPipeA PeekNamedPipe GetFileInformationByHandle GetDriveTypeW SetConsoleCtrlHandler WriteConsoleW LoadLibraryExW InterlockedFlushSList RtlUnwind OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetStringTypeW

user32

GetShellWindow GetWindowThreadProcessId GetProcessWindowStation GetUserObjectInformationW MessageBoxW

advapi32

CryptReleaseContext CryptDestroyHash CryptCreateHash CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource RegSetKeyValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor OpenProcessToken ConvertSidToStringSidW GetTokenInformation RegQueryValueExA GetUserNameA RegOpenKeyExA CloseServiceHandle OpenSCManagerW GetServiceKeyNameW QueryServiceConfigW RegCloseKey

ole32

CoCreateFreeThreadedMarshaler StringFromGUID2

oleaut32

VariantClear SysAllocString SysFreeString VariantInit SysStringLen

shlwapi

PathRemoveFileSpecA PathAppendA PathRemoveFileSpecW

bcrypt

BCryptGenRandom

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

593KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

455KB

Virtual Size

456KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

119KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2787c1826e0a0bfab7f5f7d713f0f0b0281918ef83938ebfc0374372760881c6

crypt32

ws2_32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

bcrypt

generic