6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f

Sharing

Copy URL Twitter E-mail

General

Target
6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f
Size 7.4MB
Sample260916-lrmsgssx8l
SHA256 6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f
MD5 5683ee5ae809cbd6f3dc665ef08a20e9
SHA1 3174fdca9b829d585c3a1fec5c73dd941b68e85c
SHA512 0370cdac39631e5704d8c337ad938110dfa4808cb17658f936e2014450fda84ff0f141dfab879f293ca4c4fb2d3c9319140ebfcb543659fef9b7c6010432706a
SSDEEP 98304:SezY8M9ARjVqxDmGTZatS1RgntRMukWcxf8/eSkZ8AVq4ycdg50Uhs/rpzMY:DryAZVGDmG91unzMuyfhSk8TeUhsjpz
TLSH
T149760106E19786A8DF729B3985655333D6B07CC503B0C3C76B9C4D62AB97AF49ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f

File Explorer

6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f

.exe 7.4MB

6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f

IMPHASH c20f55b54b8c6d4e0d6014e59f125bd2
SHA256 6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f
MD5 5683ee5ae809cbd6f3dc665ef08a20e9
SHA1 3174fdca9b829d585c3a1fec5c73dd941b68e85c
SHA512 0370cdac39631e5704d8c337ad938110dfa4808cb17658f936e2014450fda84ff0f141dfab879f293ca4c4fb2d3c9319140ebfcb543659fef9b7c6010432706a
SSDEEP 98304:SezY8M9ARjVqxDmGTZatS1RgntRMukWcxf8/eSkZ8AVq4ycdg50Uhs/rpzMY:DryAZVGDmG91unzMuyfhSk8TeUhsjpz
TLSH
T149760106E19786A8DF729B3985655333D6B07CC503B0C3C76B9C4D62AB97AF49ABC700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1143488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea DwmUnregisterThumbnail DwmRegisterThumbnail DwmUpdateThumbnailProperties

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

RegQueryValueExW RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegQueryValueExA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpConnect WinHttpSendRequest WinHttpOpenRequest

kernel32

GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId LocalFree FormatMessageA GetLocaleInfoEx SetPriorityClass GetCurrentProcess WriteFile SetThreadPriority WaitForSingleObject OpenProcess Sleep GetTempPathA CreateFileA GetCurrentThread LoadLibraryA QueryPerformanceFrequency DeleteFileA CloseHandle GetProcAddress GetCurrentProcessId CreateProcessA QueryPerformanceCounter GetTickCount64 WriteProcessMemory InitializeSListHead VirtualFreeEx MultiByteToWideChar GlobalAlloc GlobalFree WakeAllConditionVariable WideCharToMultiByte GlobalUnlock FreeLibrary GetModuleHandleW VirtualProtectEx GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA FindClose FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError AcquireSRWLockExclusive GetSystemTimeAsFileTime GetStartupInfoW GlobalLock SetUnhandledExceptionFilter ReleaseSRWLockExclusive ReadProcessMemory

user32

DestroyWindow SetForegroundWindow EnumDisplayMonitors UnregisterClassW RegisterClassExW ShowWindow IsWindow GetMonitorInfoW EnumDisplayDevicesW EnumDisplaySettingsW DefWindowProcW CreateWindowExW MapWindowPoints SetWindowDisplayAffinity MoveWindow SetLayeredWindowAttributes GetSystemMetrics keybd_event GetKeyState GetMessageExtraInfo MonitorFromWindow ScreenToClient BringWindowToTop SetWindowLongW TranslateMessage GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect CloseClipboard OpenClipboard GetCursorPos EmptyClipboard SetCursorPos GetClipboardData SetClipboardData SetWindowPos GetAsyncKeyState ReleaseCapture IsWindowUnicode DispatchMessageW PeekMessageW GetForegroundWindow

gdi32

GetStockObject

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Thrd_id _Thrd_join ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

winmm

timeBeginPeriod

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__intrinsic_setjmp __current_exception __C_specific_handler memset longjmp strrchr memmove memcmp memchr _CxxThrowException memcpy strstr __std_terminate __std_exception_copy __std_exception_destroy __current_exception_context

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _errno _c_exit _register_thread_local_exe_atexit_callback terminate _beginthreadex abort _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

setvbuf fgetpos fwrite __p__commode __stdio_common_vsprintf ungetc fsetpos fread _set_fmode fputc fflush fclose _fseeki64 _get_stream_buffer_pointers __acrt_iob_func __stdio_common_vsscanf _wfopen fgetc __stdio_common_vfprintf fseek ftell

api-ms-win-crt-math-l1-1-0

sqrtf atan2f log logf roundf powf fmodf sinf cosf ceilf acosf _dclass pow _dsign __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtoll strtol atoi strtod strtoull atof

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv ___lc_codepage_func

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-string-l1-1-0

wcslen tolower strlen _wcsicmp strncpy strcmp strncmp strcpy_s

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-time-l1-1-0

_localtime64_s strftime _time64

Sharing

General

Malware Config

Signatures

File Explorer

6a29bc39a412ddadbe9facef264a28387fdf8b3317be059e9b340403b6bd9c1f

dwmapi

d3d11

advapi32

d3dx11_43

winhttp

kernel32

user32

gdi32

msvcp140

winmm

imm32

d3dcompiler_43

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

generic