2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0

Sharing

Copy URL Twitter E-mail

General

Target
2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0
Size 1.2MB
Sample260916-ktfaraac67
SHA256 2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0
MD5 09ead1650d3cd02c0dd3c311aceef044
SHA1 886ecd2b2130e08e1e7e190bdfe164167ccafaf3
SHA512 5acd0ef0549c1f55e79a16160ec851f90fdf9bf9b24de43c33c09606a04f492b11ff902655f2b2fab2a2b33b89e0dec255ea8ee1d9a0883ff521e31ebf1f68aa
SSDEEP 24576:Z3WDFHsiwe3mo5QeYMA4R48sTI8HozH6uum3kg:5SWo5M1I8C63mF
TLSH
T1B8553A39B9F9F6D5C61A903458008A7BD5B23C589AA0D7BF8F51B7090E36AD01F3E271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0

File Explorer

2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0

.exe 1.2MB

2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0

IMPHASH a6275e72c585a997512bee1cee9f1fab
SHA256 2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0
MD5 09ead1650d3cd02c0dd3c311aceef044
SHA1 886ecd2b2130e08e1e7e190bdfe164167ccafaf3
SHA512 5acd0ef0549c1f55e79a16160ec851f90fdf9bf9b24de43c33c09606a04f492b11ff902655f2b2fab2a2b33b89e0dec255ea8ee1d9a0883ff521e31ebf1f68aa
SSDEEP 24576:Z3WDFHsiwe3mo5QeYMA4R48sTI8HozH6uum3kg:5SWo5M1I8C63mF
TLSH
T1B8553A39B9F9F6D5C61A903458008A7BD5B23C589AA0D7BF8F51B7090E36AD01F3E271
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

519088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32Next FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType GetCurrentProcessorNumberEx EnterCriticalSection GetSystemTimeAdjustment LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter InitializeSListHead InterlockedPopEntrySList InitializeSRWLock ReleaseSRWLockExclusive Process32First AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared InterlockedPushEntrySList CreateToolhelp32Snapshot QueryDepthSList WaitForSingleObject CreateEventA GetCurrentThreadId SetEvent ResetEvent SetThreadPriority CreateThread SetThreadIdealProcessor SetThreadGroupAffinity EnumSystemLocalesW HeapCreate SetEndOfFile MultiByteToWideChar GetLogicalProcessorInformationEx GetUserDefaultLCID QueryPerformanceFrequency CreateFileMappingA HeapDestroy GlobalMemoryStatusEx GetProcAddress CloseThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait GetModuleHandleW GetModuleHandleA GetModuleFileNameW UnmapViewOfFile IsValidLocale GetLocaleInfoW IsValidCodePage CompareStringW GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA WriteFile GetStdHandle FreeLibraryAndExitThread ExitThread MapViewOfFile GetModuleHandleExW ExitProcess RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetACP RtlUnwindEx RaiseException PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateIoCompletionPort RtlPcToFileHeader VirtualFree VirtualAlloc GetCurrentProcessId TerminateProcess IsProcessorFeaturePresent LoadLibraryA GetStartupInfoW FreeLibrary SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry SetFileCompletionNotificationModes GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteProcessMemory VirtualProtectEx RtlCaptureContext VirtualAllocEx VirtualProtect GetProcessHandleCount OpenProcess GetCurrentProcess Sleep GetProcessHeap CreateFileA HeapFree HeapAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetLastError DuplicateHandle GetCPInfo SetEnvironmentVariableW InterlockedFlushSList GetActiveProcessorGroupCount InterlockedPushListSListEx SetStdHandle CancelIoEx GetActiveProcessorCount LCMapStringEx DecodePointer LCMapStringW EncodePointer CloseHandle CreateFileW SetThreadpoolWait WideCharToMultiByte LocalFree FlsFree FlsSetValue FlsGetValue FlsAlloc WaitForSingleObjectEx GetExitCodeThread TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW InitializeCriticalSectionEx WriteConsoleW

user32

MessageBoxW GetCursorPos

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

SysAllocString SysFreeString SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetUBound VariantClear

ws2_32

shutdown WSASocketW getsockname WSARecv WSASend setsockopt FreeAddrInfoW GetAddrInfoW WSAIoctl closesocket bind WSACleanup connect WSAGetLastError inet_pton WSAStartup recv getsockopt htonl send socket htons

ntdll

RtlIpv6AddressToStringExA RtlIpv4StringToAddressExA RtlIpv4AddressToStringExA RtlIpv6StringToAddressExA RtlNtStatusToDosError RtlInitUnicodeString NtSetInformationThread

advapi32

EventWriteTransfer RegOpenKeyExA EventUnregister RegQueryValueExA RegCloseKey RegNotifyChangeKeyValue EventRegister

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceLuidToAlias GetIfTable2 FreeMibTable ResolveIpNetEntry2 GetBestRoute2 GetIpNetEntry2 GetAdaptersAddresses GetCurrentThreadCompartmentId SetCurrentThreadCompartmentId

winmm

timeGetDevCaps

bcrypt

BCryptDestroyHash BCryptGenerateSymmetricKey BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptSetProperty BCryptCreateHash BCryptHashData BCryptCloseAlgorithmProvider

secur32

FreeCredentialsHandle SetCredentialsAttributesW FreeContextBuffer QuerySecurityContextToken DeleteSecurityContext AcceptSecurityContext QueryContextAttributesW AcquireCredentialsHandleW InitializeSecurityContextW

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertSaveStore CertGetCertificateChain CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty CertGetNameStringA CertFreeCertificateChain CertAddCertificateLinkToStore

sspicli

QueryContextAttributesExW

Name

.text

Size

674KB

Virtual Size

674KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2f55720be920de3b60f0d0bf4630a0d7e63fa746320b5982198427998bacb1b0

kernel32

user32

ole32

oleaut32

ws2_32

ntdll

advapi32

iphlpapi

winmm

bcrypt

secur32

crypt32

sspicli

generic