4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1

Sharing

Copy URL Twitter E-mail

General

Target
4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1
Size 481KB
Sample260916-jsyv2axclc
SHA256 4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1
MD5 fda2a0fa3f642976843c796e60f51412
SHA1 4dd7e0b15625d25cdb89f765e2cd6e63ac5c35c9
SHA512 e83f7b5af36cc808a421f89ad1b89b92a49920172bcea7dd76365e14cc6dd7936f8677fefe1b8a44126685331e4e0769f2865c96ee09e882bd6a2f60edd9a747
SSDEEP 12288:pHEXY52v/NytmYFkmhO8uTDb6GnNd4ENkxmZ:pHEXY52vFy0YBO/Xncrw
TLSH
T184A45B04FF9641F5F8B349301A76E17F5A3279B0E939CC4DD6490E09EA73E249A29723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1

File Explorer

4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1

.exe 481KB

4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1

IMPHASH bb68e90c297baf76aa832df5382214c2
SHA256 4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1
MD5 fda2a0fa3f642976843c796e60f51412
SHA1 4dd7e0b15625d25cdb89f765e2cd6e63ac5c35c9
SHA512 e83f7b5af36cc808a421f89ad1b89b92a49920172bcea7dd76365e14cc6dd7936f8677fefe1b8a44126685331e4e0769f2865c96ee09e882bd6a2f60edd9a747
SSDEEP 12288:pHEXY52v/NytmYFkmhO8uTDb6GnNd4ENkxmZ:pHEXY52vFy0YBO/Xncrw
TLSH
T184A45B04FF9641F5F8B349301A76E17F5A3279B0E939CC4DD6490E09EA73E249A29723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4123

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW StartServiceW SystemFunction036

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_GetIcon ImageList_GetImageCount ImageList_ReplaceIcon ImageList_SetOverlayImage InitCommonControlsEx

comdlg32

GetSaveFileNameW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MoveToEx Polyline SelectObject SetBkColor SetBkMode SetTextColor

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateSemaphoreA DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitThread FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessAffinityMask GetProcessHeap GetShortPathNameW GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetUserDefaultUILanguage GetVersion GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocalReAlloc MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrcatW lstrcmpW lstrcmpiW lstrcpynW lstrlenW

api-ms-win-crt-convert-l1-1-0

_wtoi mbsrtowcs wcstol

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

_setjmp3 longjmp memchr memcmp memcpy memmove strstr wcschr wcsrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vswscanf _close _fileno _lseek _open _read _setmode _wopen _write _write fflush setvbuf

api-ms-win-crt-string-l1-1-0

_stricmp _strdup _strnicmp _wcsicmp _wcsicmp _wcsnicmp _wcsnicmp memset strlen strncmp towlower wcscmp wcscpy wcscpy_s wcslen wcsncmp

api-ms-win-crt-utility-l1-1-0

qsort rand_s

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

setupapi

CM_Disable_DevNode CM_Enable_DevNode CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key CM_Reenumerate_DevNode SetupCloseInfFile SetupCopyOEMInfW SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiDestroyClassImageList SetupDiDestroyDeviceInfoList SetupDiDestroyDriverInfoList SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupDiGetClassDescriptionW SetupDiGetClassDevsW SetupDiGetClassImageIndex SetupDiGetClassImageList SetupDiGetDeviceInstallParamsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetINFClassW SetupDiInstallDevice SetupDiLoadDeviceIcon SetupDiOpenDeviceInfoW SetupDiRemoveDevice SetupDiSetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetSelectedDriverW SetupFindFirstLineW SetupGetStringFieldW SetupOpenInfFileW SetupUninstallOEMInfW

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW ExtractIconExW SHBrowseForFolderW SHFileOperationW SHGetPathFromIDListW ShellExecuteW StrStrIW

shlwapi

PathFindExtensionW PathIsDirectoryW PathMatchSpecW SHLoadIndirectString

user32

AppendMenuW BeginPaint CallWindowProcW ChangeWindowMessageFilterEx ClientToScreen CloseClipboard CopyImage CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW DrawFrameControl DrawTextW EmptyClipboard EnableWindow EndDialog EndPaint EnumChildWindows FillRect FindWindowExW FrameRect GetAncestor GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetDlgItemTextW GetMessagePos GetMessageW GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindow GetWindowDC GetWindowLongW GetWindowRect GetWindowTextW InflateRect InsertMenuItemW InvalidateRect IsDialogMessageW IsDlgButtonChecked IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW LockWindowUpdate MapWindowPoints MessageBoxW OffsetRect OpenClipboard PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassW RegisterDeviceNotificationW ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendDlgItemMessageW SendMessageTimeoutW SendMessageW SetCapture SetClipboardData SetDlgItemTextW SetForegroundWindow SetMenuInfo SetProcessDPIAware SetPropW SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UnregisterDeviceNotification UpdateWindow wsprintfW

uxtheme

SetWindowTheme

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

344B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4bd26d20be9c02ccdd45d66389cb3d4de017625e497acaac52e0e172ec1e0ac1

advapi32

comctl32

comdlg32

gdi32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

setupapi

shell32

shlwapi

user32

uxtheme

version

generic