5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474

Sharing

Copy URL Twitter E-mail

General

Target
5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474
Size 877KB
Sample260916-h4e2ma1v7p
SHA256 5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474
MD5 bdcf2fe011e5cb01afa010fe71fe2ee9
SHA1 2ef16a07d5c2cacf9fd7b7d5cdc3db56085adb4a
SHA512 a078420fdc90f2b6a239e9c8225f1bb3379352178ce279045cde40eab24253d40d2883fa80388a8b283dd1b0c80f8e6b43b8adfb6937a124064f779578fcd5cd
SSDEEP 24576:4U3tZ6jjPHmpn/Rwal8rxx4kRRf/mlLA:J3WLGx/Rwal8rxxDQM
TLSH
T1AF15D016E7A454F9E1A7D138CE629A05EB727C890760ABCF13944E671F376D04E3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474

File Explorer

5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474

.exe 877KB

5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474

IMPHASH d2b9f9609fbac2decf9fe7dc2ffd7942
SHA256 5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474
MD5 bdcf2fe011e5cb01afa010fe71fe2ee9
SHA1 2ef16a07d5c2cacf9fd7b7d5cdc3db56085adb4a
SHA512 a078420fdc90f2b6a239e9c8225f1bb3379352178ce279045cde40eab24253d40d2883fa80388a8b283dd1b0c80f8e6b43b8adfb6937a124064f779578fcd5cd
SSDEEP 24576:4U3tZ6jjPHmpn/Rwal8rxx4kRRf/mlLA:J3WLGx/Rwal8rxxDQM
TLSH
T1AF15D016E7A454F9E1A7D138CE629A05EB727C890760ABCF13944E671F376D04E3EB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132960

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash

wintrust

WinVerifyTrust

crypt32

CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext CryptQueryObject CryptMsgClose

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shell32

Shell_NotifyIconW

comctl32

ord412 ord410 ord413 InitCommonControlsEx

uxtheme

SetWindowTheme

msimg32

GradientFill

kernel32

GlobalUnlock SetConsoleCtrlHandler GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle Sleep SetConsoleCP GetCurrentProcessId GetConsoleWindow SetConsoleOutputCP AllocConsole OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle QueryFullProcessImageNameW ReadFile SetFilePointer CreateFileW GetLastError EnumResourceNamesW FreeLibrary LoadLibraryExW lstrcpynW LocalAlloc LocalFree GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetTickCount IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetModuleHandleW GlobalLock FindResourceW LoadResource GlobalFree GlobalAlloc LockResource SizeofResource GetConsoleMode ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetEndOfFile WriteConsoleW RtlUnwind GetUserDefaultLCID RtlCaptureContext GetCPInfo GetProcAddress GetSystemTimeAsFileTime LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection

user32

DrawTextW GetClientRect LoadCursorW KillTimer PtInRect SetFocus TrackMouseEvent MapWindowPoints LoadIconW PostQuitMessage DestroyIcon SetTimer UpdateWindow TranslateMessage ChildWindowFromPointEx GetWindowTextW EnableWindow EndPaint BeginPaint InvalidateRect LoadImageW SetForegroundWindow DispatchMessageW CreatePopupMenu TrackPopupMenu DestroyMenu InsertMenuW GetCursorPos GetWindowTextLengthW GetMessageW DefWindowProcW PostMessageW GetWindowRect GetFocus DestroyWindow IsWindowVisible SetWindowPos MessageBoxW SetWindowLongPtrW FillRect CreateWindowExW SendMessageW GetSystemMetrics UnregisterClassW SetWindowTextW InvalidateRgn GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow ReleaseCapture

gdi32

CreateRectRgnIndirect DeleteDC BitBlt GetStockObject CreateFontW CreateCompatibleDC CreateCompatibleBitmap SelectObject SetTextColor SetBkMode LineTo CreatePen Rectangle Polygon MoveToEx SetBkColor DeleteObject CreateSolidBrush CombineRgn RoundRect

advapi32

RegCloseKey CredReadW CredFree RegCreateKeyExW RegSetValueExW RegGetValueW CredWriteW

ole32

CreateStreamOnHGlobal

gdiplus

GdiplusStartup GdipDrawImageRectRectI GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipDeleteGraphics GdipCreateFromHDC GdipFree GdipCreateImageAttributes GdipSetPixelOffsetMode GdipDrawLine GdipSetPenLineCap197819 GdipSetSmoothingMode GdipGetImageHeight GdipDisposeImageAttributes GdipDrawImageRectI GdipAlloc GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdiplusShutdown

Name

.text

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

475KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5cf5f5f44608e12630b455ed40a1c6d27e41fad1b5debd94710c109bf97f2474

bcrypt

wintrust

crypt32

version

shell32

comctl32

uxtheme

msimg32

kernel32

user32

gdi32

advapi32

ole32

gdiplus

generic