d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0

Sharing

Copy URL Twitter E-mail

General

Target
d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0
Size 1.2MB
Sample260916-3khzdsfe42
SHA256 d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0
MD5 174b986a448de616f3706ea3044df0ad
SHA1 efb2ea449f630666422289b027d3f9092936b21e
SHA512 1dd21f20559eceeda3070c23851fda187938964644fdf6a98b69e8f0f2778779777aa9ebdce5586c689407fd6c1c666eb72f784a2627a37d8009f3e28eaae96e
SSDEEP 12288:0Z7gYleUYQPtU+xvF+tJk/mVABZweu6rBB9:0ZMddQVbxvFkretrBB9
TLSH
T16245A46123E48956F2F3973858B292202F367D525B35CB7F824095ED0B33BC29EA5727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0

File Explorer

d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0

.exe 1.2MB

d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0

IMPHASH 0f62d0b2c35816047308d786ca875c72
SHA256 d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0
MD5 174b986a448de616f3706ea3044df0ad
SHA1 efb2ea449f630666422289b027d3f9092936b21e
SHA512 1dd21f20559eceeda3070c23851fda187938964644fdf6a98b69e8f0f2778779777aa9ebdce5586c689407fd6c1c666eb72f784a2627a37d8009f3e28eaae96e
SSDEEP 12288:0Z7gYleUYQPtU+xvF+tJk/mVABZweu6rBB9:0ZMddQVbxvFkretrBB9
TLSH
T16245A46123E48956F2F3973858B292202F367D525B35CB7F824095ED0B33BC29EA5727
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyExW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

comctl32

InitCommonControls ord320 ord323 ord324 ord388 PropertySheetW

comdlg32

ChooseColorW ChooseFontW GetOpenFileNameW

gdi32

CreateFontIndirectW CreateFontW CreateSolidBrush DeleteObject GetDeviceCaps GetObjectW SetBkColor SetTextColor

kernel32

CloseHandle CreateFileW CreateProcessW DeviceIoControl ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageA GetCommandLineW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetStartupInfoW GetTickCount GetVolumeInformationW GlobalGetAtomNameW HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsWow64Process MulDiv MultiByteToWideChar SetVolumeLabelW WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpiW

ntdll

RtlDosPathNameToNtPathName_U RtlFreeUnicodeString _vsnprintf

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

shell32

ord155 ord195 SHBindToParent SHBrowseForFolderW SHCreateDirectoryExW SHFileOperationW SHGetDesktopFolder SHGetFolderLocation SHGetFolderPathW ShellExecuteW

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveExtensionW StrDupW StrRetToBufW StrRetToStrW

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _assert _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _strdup _wcsdup _wcsicmp _wcsnicmp bsearch exit free fwrite getenv malloc memcpy memmove realloc setlocale strchr strcmp strcpy strcspn strlen strrchr toupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstol wcstoul

user32

AdjustWindowRectEx CheckDlgButton CheckRadioButton DestroyIcon DialogBoxParamW DrawEdge DrawFocusRect DrawFrameControl DrawIconEx EnableWindow EndDialog EnumWindows FillRect FrameRect GetClientRect GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemInt GetDpiForWindow GetMenu GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindowLongPtrW GetWindowLongW GetWindowTextLengthW GetWindowTextW InvalidateRect IsDlgButtonChecked KillTimer LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxIndirectW MessageBoxW MoveWindow ReleaseDC SendDlgItemMessageW SendMessageW SetCursor SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetFocus SetSysColors SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow SystemParametersInfoW

uxtheme

ord2 ord3 ord4 ord8 ord9 ord10 CloseThemeData DrawThemeBackground DrawThemeParentBackground GetCurrentThemeName GetThemeMargins IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeDataForDpi

winmm

PlaySoundW midiOutGetDevCapsW midiOutGetNumDevs

Name

.text

Size

88KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

84KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

652KB

Virtual Size

648KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

372B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d37c200b32a41016819fba52ca3b5d0d65f1e2427edfd62a65a334c148030ee0

advapi32

comctl32

comdlg32

gdi32

kernel32

ntdll

ole32

shell32

shlwapi

ucrtbase

user32

uxtheme

winmm

generic