0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088

Sharing

Copy URL Twitter E-mail

General

Target
0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088
Size 948KB
Sample260916-3w8deswhpg
SHA256 0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088
MD5 620cc2a863ddf20b20fffc6c98b636a9
SHA1 9321325ad6d743bc4a889fb3115f84b7a3eb88ba
SHA512 168ae69cdbbba03e86c3d7f42ceef98ed2944e2c1aeb6176687e004e06c54f1157a38f0c6fc259240ca6b15d14aac282b1b8381c77a1dabb7d4e13519f8a029c
SSDEEP 12288:9H8HIr1brhzZ0vZms+l48ZIWdkpVQGyxqcwd:9RBbrhzZM8JdezU2d
TLSH
T18C250900B2A958E3D833833449DBE37A673ABA425763CF57EB088D1D5E27BC32E55605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088

File Explorer

0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088

.dll 948KB

0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088

IMPHASH 1093a7f636388eff4863c130dacbb001
SHA256 0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088
MD5 620cc2a863ddf20b20fffc6c98b636a9
SHA1 9321325ad6d743bc4a889fb3115f84b7a3eb88ba
SHA512 168ae69cdbbba03e86c3d7f42ceef98ed2944e2c1aeb6176687e004e06c54f1157a38f0c6fc259240ca6b15d14aac282b1b8381c77a1dabb7d4e13519f8a029c
SSDEEP 12288:9H8HIr1brhzZ0vZms+l48ZIWdkpVQGyxqcwd:9RBbrhzZM8JdezU2d
TLSH
T18C250900B2A958E3D833833449DBE37A673ABA425763CF57EB088D1D5E27BC32E55605
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyW RegQueryValueExW

comctl32

CreateStatusWindowW ImageList_Destroy ImageList_LoadImageW

gdi32

GetDeviceCaps

kernel32

ActivateActCtx CloseHandle CreateActCtxW CreateFileW CreateProcessW DeactivateActCtx DisableThreadLibraryCalls EnumResourceNamesW ExitProcess FindClose FindFirstFileW FindNextFileW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetTickCount GlobalAlloc GlobalFree HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MulDiv MultiByteToWideChar ReleaseActCtx SizeofResource WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpW lstrcmpiW

ntdll

_vsnprintf

ole32

CoCreateInstance CoInitialize CoRegisterClassObject CoRevokeClassObject CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CreateOleAdviseHolder CreateStreamOnHGlobal OleRegGetUserType PropVariantClear StgCreateStorageEx

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear SafeArrayDestroy SafeArrayGetDim SafeArrayGetElemsize SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetElement LoadRegTypeLib SafeArrayCreateVector

shell32

SHGetFolderPathW ShellAboutW ShellExecuteExW

shlwapi

ord167 PathAppendW PathCreateFromUrlW PathFindExtensionW PathIsURLW SHRegCloseUSKey SHRegEnumUSValueW SHRegOpenUSKeyW SHRegQueryUSValueW UrlApplySchemeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsdup _wcsnicmp calloc free fwrite getenv malloc memcmp memcpy memmove realloc strchr strcmp strcspn strlen wcschr wcslen wcsncmp wcstol

urlmon

CoInternetParseUrl CreateAsyncBindCtx CreateURLMoniker CreateURLMonikerEx2 ReleaseBindInfo

user32

CreatePopupMenu CreateWindowExW DdeCmpStringHandles DdeCreateStringHandleW DdeFreeStringHandle DdeGetData DdeGetLastError DdeInitializeW DdeNameService DdeUninitialize DefWindowProcW DestroyIcon DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetClientRect GetDC GetDlgItem GetMenuItemCount GetMenuItemInfoW GetMessageW GetPropW GetSubMenu GetSystemMetrics GetWindowLongW GetWindowTextLengthW GetWindowTextW InsertMenuItemW IsWindowVisible LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW PostMessageW PostQuitMessage RegisterClassExW ReleaseDC SendMessageW SetFocus SetMenu SetPropW SetWindowLongW SetWindowPos ShowWindow TranslateMessage UnregisterClassW

Name

.text

Size

232KB

Virtual Size

231KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

108KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

40KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

292B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0aada881b79f3929789bd5fb3f7c8c3386a7b0e5ed8303a8335ca3782c68f088

advapi32

comctl32

gdi32

kernel32

ntdll

ole32

oleaut32

shell32

shlwapi

ucrtbase

urlmon

user32

generic