c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda

Sharing

Copy URL Twitter E-mail

General

Target
c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda
Size 295KB
Sample260916-mcl33ss17p
SHA256 c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda
MD5 28a43f94d0d35e2b954700974a75585a
SHA1 5a426d99fa5cac876460a316befc34cef89ef572
SHA512 709df2bef7dd970756d26fa079fdbf3cfe8c762ec1d3802c2cd539462dc99dc504c7249f2c9e5d1a5ac85852849a0353abc2a5b63223623e9f86448ffd8686bd
SSDEEP 3072:cHuBFi3FZtGAtMOZJkE143dJQjQLnNzkrDP5RLm07qlKV:jBFi3FLV1UCrDP3Lm0YK
TLSH
T1A954E601B5D99CEAD5BB0573BCEA29590D75FE04DF209B4F5308284EAE73A81BE18713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda

File Explorer

c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda

.dll 295KB

c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda

IMPHASH ca14fc25617aadeb3fc09c8157fa209e
SHA256 c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda
MD5 28a43f94d0d35e2b954700974a75585a
SHA1 5a426d99fa5cac876460a316befc34cef89ef572
SHA512 709df2bef7dd970756d26fa079fdbf3cfe8c762ec1d3802c2cd539462dc99dc504c7249f2c9e5d1a5ac85852849a0353abc2a5b63223623e9f86448ffd8686bd
SSDEEP 3072:cHuBFi3FZtGAtMOZJkE143dJQjQLnNzkrDP5RLm07qlKV:jBFi3FLV1UCrDP3Lm0YK
TLSH
T1A954E601B5D99CEAD5BB0573BCEA29590D75FE04DF209B4F5308284EAE73A81BE18713
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83304

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlRaiseException vDbgPrintExWithPrefix

kernel32

CloseHandle CreateFileMappingW DeleteCriticalSection DisableThreadLibraryCalls DuplicateHandle EnterCriticalSection EnumResourceNamesW FindResourceW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFree GlobalGetAtomNameW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc MapViewOfFile MultiByteToWideChar OpenProcess QueryPerformanceCounter SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect VirtualQuery WideCharToMultiByte

msvcrt

__dllonexit _amsg_exit _assert _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf abort bsearch calloc free fwrite memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp vfprintf wcstoul _wcsicmp

ole32

CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CreateStreamOnHGlobal HMENU_UserFree HMENU_UserMarshal HMENU_UserSize HMENU_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VariantClear VariantInit

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction

user32

ChildWindowFromPointEx ClientToScreen GetAncestor GetClientRect GetGUIThreadInfo GetWindow GetWindowLongW GetWindowThreadProcessId IsChild IsWindow IsWindowVisible LoadStringA LoadStringW MapWindowPoints PtInRect RealGetWindowClassW ScreenToClient SendMessageW WindowFromPoint

Name

.text

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

725B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c2fc1e159dcdf08d4122eb75847814a1268224dfbf2f8f0bd53db46569ef7eda

ntdll

kernel32

msvcrt

ole32

oleaut32

rpcrt4

user32

generic