0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070

Sharing

Copy URL Twitter E-mail

General

Target
0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070
Size 278KB
Sample260916-massvas14q
SHA256 0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070
MD5 064f044491719d167a0733848ae30fff
SHA1 95802837aeaa0d02661846db780ee4edc5ab6376
SHA512 d1e54f29102e8653c788b344740afbf0288300085af89a70a75bd7d72a5272ce7fd71d27f6ac5a35d62621a95459c5d5bd4272839b93f1d34ef7d435c00f4428
SSDEEP 3072:MtAC6V9ytEAeYblHsflmffqM0Kod0zlXkFQC3Xlcpc8vshnDwybgg+:hlVSEAeglHsflmfrulcpcPlDwy0g+
TLSH
T12B54E816A7EE4693FDF62E309AB9A16E06B6FC00DA31CF0FD748045F3411A41EE65B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070

File Explorer

0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070

.exe 278KB

0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070

IMPHASH 9b9b759fda724ae05ce910a26c349a70
SHA256 0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070
MD5 064f044491719d167a0733848ae30fff
SHA1 95802837aeaa0d02661846db780ee4edc5ab6376
SHA512 d1e54f29102e8653c788b344740afbf0288300085af89a70a75bd7d72a5272ce7fd71d27f6ac5a35d62621a95459c5d5bd4272839b93f1d34ef7d435c00f4428
SSDEEP 3072:MtAC6V9ytEAeYblHsflmffqM0Kod0zlXkFQC3Xlcpc8vshnDwybgg+:hlVSEAeglHsflmfrulcpcPlDwy0g+
TLSH
T12B54E816A7EE4693FDF62E309AB9A16E06B6FC00DA31CF0FD748045F3411A41EE65B16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

67625

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

NtInitializeRegistry NtQuerySystemTime NtRaiseHardError NtSetDefaultLocale NtShutdownSystem RtlAdjustPrivilege RtlAllocateHeap RtlAssert RtlFreeHeap RtlSetProcessIsCritical RtlSetThreadIsCritical RtlUnicodeStringToInteger vDbgPrintExWithPrefix

advapi32

AddAccessAllowedAceEx AllocateAndInitializeSid CloseServiceHandle CreateProcessAsUserW FreeSid GetLengthSid GetTokenInformation ImpersonateLoggedOnUser InitializeAcl InitializeSecurityDescriptor MakeSelfRelativeSD OpenSCManagerA OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegEnumKeyExW RegOpenCurrentUser RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RevertToSelf SetEntriesInAclA SetSecurityDescriptorDacl

kernel32

Beep CloseHandle CreateEventW CreateProcessW CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetExitCodeThread GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetStartupInfoA GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalAlloc LocalFree LocalReAlloc OpenEventW QueryPerformanceCounter ResetEvent RtlUnwind SetEvent SetLastError SetUnhandledExceptionFilter Sleep SleepEx TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

mpr

WNetAddConnectionA WNetClearConnections WNetCloseEnum WNetEnumResourceA WNetOpenEnumA

msvcrt

__dllonexit __getmainargs __initenv __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _fpreset _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf abort bsearch calloc exit free fwrite iswctype malloc memcmp memmove signal sprintf strchr strcmp strcpy strcspn strncmp vfprintf swprintf wcschr wcscmp wcscpy wcslen wcsncpy

rpcrt4

NdrServerCall2 RpcServerListen RpcServerRegisterIf RpcServerUseProtseqEpW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock LoadUserProfileW UnloadUserProfile

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowExW CreateWindowStationW DefWindowProcA DeleteMenu DestroyWindow DialogBoxIndirectParamW DialogBoxParamA DialogBoxParamW DispatchMessageW EndDialog ExitWindowsEx GetDesktopWindow GetDlgItemTextW GetLastInputInfo GetMessageW GetSystemMenu GetSystemMetrics GetUserObjectInformationW GetWindowLongA GetWindowLongW GetWindowPlacement KillTimer LoadKeyboardLayoutW LoadStringW MessageBoxW OpenInputDesktop PostMessageA PostMessageW PostQuitMessage RegisterClassExW RegisterHotKey RegisterLogonProcess SetDlgItemTextW SetLogonNotifyWindow SetProcessWindowStation SetThreadDesktop SetTimer SetUserObjectSecurity SetWindowLongW SetWindowPlacement SetWindowPos SetWindowStationUser SwitchDesktop SystemParametersInfoW TranslateMessage UnregisterClassW UnregisterHotKey UpdatePerUserSystemParameters wsprintfW

Name

.text

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rossym

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0f2c3654c74711386f3522e5cd46fdec850440945e2bc7cbb0761e5fd9fae070

ntdll

advapi32

kernel32

mpr

msvcrt

rpcrt4

userenv

user32

generic