aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0

Sharing

Copy URL Twitter E-mail

General

Target
aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0
Size 618KB
Sample260916-mapfeswygx
SHA256 aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0
MD5 bdd83ed5cb50ce0d4c2938c41eefaf07
SHA1 a5fe113aa11956c05ac3ef54e57c9c67bd355969
SHA512 cd8bdc08a793ceb97d13b77a3955b8782ae61bac2ebdb7b086fb0eddf54823420fb08edccc804a66dddb7abc3b2b43bed5773df4703b94b0d3bb01571d94ef48
SSDEEP 12288:5PRtu0dFv9VYciZ6YaW27tMlM9HclbCuQ:fXD1iZ6YE7toMxcm
TLSH
T1E6D45E11E9C688F3DB9A09714963A20F46BBEA00E753EFD77F0964B86A617112F1D31C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0

File Explorer

aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0

.dll 618KB

aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0

IMPHASH 4e4e9d527e4521493a74044092530c36
SHA256 aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0
MD5 bdd83ed5cb50ce0d4c2938c41eefaf07
SHA1 a5fe113aa11956c05ac3ef54e57c9c67bd355969
SHA512 cd8bdc08a793ceb97d13b77a3955b8782ae61bac2ebdb7b086fb0eddf54823420fb08edccc804a66dddb7abc3b2b43bed5773df4703b94b0d3bb01571d94ef48
SSDEEP 12288:5PRtu0dFv9VYciZ6YaW27tMlM9HclbCuQ:fXD1iZ6YE7toMxcm
TLSH
T1E6D45E11E9C688F3DB9A09714963A20F46BBEA00E753EFD77F0964B86A617112F1D31C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4790

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint NlsMbCodePageTag NtClearEvent NtClose NtCreateEvent NtCreateMutant NtCreateSection NtDuplicateObject NtMapViewOfSection NtOpenKey NtOpenProcess NtQueryDefaultLocale NtQueryInformationProcess NtQueryValueKey NtReadVirtualMemory NtReleaseMutant NtResumeThread NtSetEvent NtTerminateProcess NtUnmapViewOfSection NtWaitForSingleObject RtlAcquireResourceExclusive RtlAcquireResourceShared RtlAllocateHeap RtlAnsiCharToUnicodeChar RtlAnsiStringToUnicodeString RtlAppendUnicodeToString RtlAreBitsClear RtlAreBitsSet RtlAssert RtlCompareUnicodeString RtlCopyUnicodeString RtlCreateUserThread RtlDeleteCriticalSection RtlDosSearchPath_U RtlDuplicateUnicodeString RtlEnterCriticalSection RtlEqualUnicodeString RtlExitUserThread RtlFindMessage RtlFreeHeap RtlFreeUnicodeString RtlGetLastNtStatus RtlInitAnsiString RtlInitUnicodeString RtlInitializeBitMap RtlInitializeCriticalSection RtlInitializeResource RtlLeaveCriticalSection RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlNtStatusToDosError RtlOpenCurrentUser RtlPrefixUnicodeString RtlReleaseResource RtlSetBits RtlUnicodeStringToAnsiString RtlUnicodeStringToInteger RtlxUnicodeStringToAnsiSize

kernel32

Beep CloseHandle CreateRemoteThread CreateThread DeleteCriticalSection EnterCriticalSection GetACP GetExitCodeThread GetLastError GetModuleHandleW GetOEMCP GetProcAddress GetSystemWindowsDirectoryW GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection IsValidCodePage LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar RaiseException RtlUnwind SetLastError TerminateThread WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte

csrsrv

CsrAddStaticServerThread CsrConnectToUser CsrCreateWait CsrDereferenceProcess CsrDereferenceThread CsrDereferenceWait CsrExecServerThread CsrGetProcessLuid CsrImpersonateClient CsrLockProcessByClientId CsrLockThreadByClientId CsrNotifyWait CsrQueryApiPort CsrReferenceThread CsrRevertToSelf CsrSetBackgroundPriority CsrSetForegroundPriority CsrShutdownProcesses CsrUnlockProcess CsrUnlockThread CsrValidateMessageBuffer

basesrv

BaseSetProcessCreateNotify

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgnIndirect CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesExW GetCurrentObject GetDeviceCaps GetObjectW GetPaletteEntries GetTextMetricsW InvertRgn PatBlt RealizePalette SelectObject SelectPalette SetBkColor SetDIBitsToDevice SetSystemPaletteUse SetTextColor TextOutW TranslateCharsetInfo

user32

AppendMenuW BeginPaint ChangeDisplaySettingsW CloseClipboard CloseDesktop CloseWindowStation CopyIcon CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawMenuBar EmptyClipboard EnableMenuItem EndPaint EnumThreadWindows GetClipboardData GetCursorPos GetDC GetDlgItem GetKeyState GetKeyboardLayoutNameA GetKeyboardLayoutNameW GetKeyboardState GetMenuItemInfoW GetMessageW GetMonitorInfoW GetScrollInfo GetSystemMenu GetSystemMetrics GetTaskmanWindow GetUserObjectInformationW GetWindow GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect InvalidateRgn IsClipboardFormatAvailable IsDialogMessageW IsIconic IsWindow IsZoomed KillTimer LoadCursorW LoadImageW LoadStringW MapVirtualKeyW MessageBoxTimeoutW MonitorFromWindow OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW PrivateExtractIconsW RegisterClassExW RegisterWindowMessageW ReleaseCapture ReleaseDC ScrollWindowEx SendMessageTimeoutW SendMessageW SendNotifyMessageW SetCapture SetClipboardData SetCursor SetForegroundWindow SetMenuItemInfoW SetScrollInfo SetThreadDesktop SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowScrollBar ShowWindow ShowWindowAsync ToUnicodeEx TrackPopupMenuEx TranslateMessage UnregisterClassW UpdateWindow VkKeyScanW WindowFromPoint

Name

.text

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

322KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aabd06d945df687a3c03513d5111676c416c6f98f41cd42bb986ea8ae44335e0

ntdll

kernel32

csrsrv

basesrv

gdi32

user32

generic