a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a

Sharing

Copy URL Twitter E-mail

General

Target
a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a
Size 162KB
Sample260916-mewejayerg
SHA256 a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a
MD5 08667e2ccfa3dd12d516e7d2a3fe6f3c
SHA1 ffcbca5b8487f1c8e16dac98f12dbe53e90be421
SHA512 6341431820e096d6ee182775018b33a04d25fda0138e9fd861e9c78ae26afc1b5a9dd0194d7190ea7ce92dd83c6bd59b31087e55cac9aa6b9c84cccb9e4d6a50
SSDEEP 3072:UB8nttvnNtI+FZS4fOj4V62F5Dj/HQuczL7EkSR0c4eclW7+LTXZfao7EfA2B9iD:UKtt9ZS5MHQucrR/YQgs4X0+Fvc9
TLSH
T164F3291DBD87CFF2D36C20B05EDBA1EA5E37D520A7114A1BC368D222A813F656F94709
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a

File Explorer

a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a

.dll 162KB

a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a

IMPHASH 971becae52e50069af0690106b67d6ec
SHA256 a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a
MD5 08667e2ccfa3dd12d516e7d2a3fe6f3c
SHA1 ffcbca5b8487f1c8e16dac98f12dbe53e90be421
SHA512 6341431820e096d6ee182775018b33a04d25fda0138e9fd861e9c78ae26afc1b5a9dd0194d7190ea7ce92dd83c6bd59b31087e55cac9aa6b9c84cccb9e4d6a50
SSDEEP 3072:UB8nttvnNtI+FZS4fOj4V62F5Dj/HQuczL7EkSR0c4eclW7+LTXZfao7EfA2B9iD:UKtt9ZS5MHQucrR/YQgs4X0+Fvc9
TLSH
T164F3291DBD87CFF2D36C20B05EDBA1EA5E37D520A7114A1BC368D222A813F656F94709
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint RtlRaiseException vDbgPrintExWithPrefix

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

CloseHandle CompareFileTime CompareStringA CreateFileW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GetUserDefaultUILanguage HeapAlloc HeapFree InitializeCriticalSection IsBadReadPtr IsBadStringPtrA IsBadStringPtrW IsBadWritePtr LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LocalReAlloc LocalSize MultiByteToWideChar QueryPerformanceCounter ReadFile SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WideCharToMultiByte lstrcatW lstrcmpA lstrcmpW lstrcmpiW lstrcpyW lstrlenA lstrlenW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf abort bsearch calloc free fwrite memchr memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp vfprintf

shlwapi

SHCreateStreamOnFileEx StrChrA StrChrIA

user32

LoadStringW MessageBoxW

BMAPIAddress BMAPIDetails BMAPIFindNext BMAPIGetAddress BMAPIGetReadMail BMAPIReadMail BMAPIResolveName BMAPISaveMail BMAPISendMail BuildDisplayTable CbOfEncoded@4 CchOfEncoding ChangeIdleRoutine CloseIMsgSession CreateIProp@24 CreateTable DeinitMapiUtil@0 DeregisterIdleRoutine DllCanUnloadNow DllGetClassObject EnableIdleRoutine EncodeID FBadColumnSet@4 FBadEntryList@4 FBadProp@4 FBadPropTag@4 FBadRestriction FBadRglpNameID FBadRglpszA@8 FBadRglpszW@8 FBadRow@4 FBadRowSet@4 FBadSortOrderSet FBinFromHex@8 FDecodeID FEqualNames@8 FGetComponentPath FGetComponentPath@20 FPropCompareProp@12 FPropContainsProp@12 FPropExists@8 FixMAPI FixMAPI@0 FreePadrlist@4 FreeProws@4 FtAdcFt FtAddFt@16 FtDivFtBogus FtMulDw@12 FtMulDwDw@8 FtNegFt@8 FtSubFt@16 FtgRegisterIdleRoutine GetAttribIMsgOnIStg GetOutlookVersion GetOutlookVersion@0 GetTnefStreamCodepage GetTnefStreamCodepage@12 HexFromBin@12 HrAddColumns HrAddColumnsEx HrAllocAdviseSink HrComposeEID HrComposeMsgID HrDecomposeEID HrDecomposeMsgID HrDispatchNotifications@4 HrEntryIDFromSz HrGetOmiProvidersFlags HrGetOmiProvidersFlags@8 HrGetOneProp@12 HrIStorageFromStream HrQueryAllRows@24 HrSetOmiProvidersFlagsInvalid HrSetOmiProvidersFlagsInvalid@4 HrSetOneProp@8 HrSzFromEntryID HrThisThreadAdviseSink@8 HrValidateIPMSubtree HrValidateParameters InstallFilterHook IsBadBoundedStringPtr@8 LAUNCHWIZARD LPropCompareProp@8 LaunchWizard LpValFindProp@12 MAPIAddress MAPIAdminProfiles MAPIAdminProfiles@8 MAPIAllocateBuffer MAPIAllocateBuffer@8 MAPIAllocateMore MAPIAllocateMore@12 MAPIDeinitIdle MAPIDeleteMail MAPIDetails MAPIFindNext MAPIFreeBuffer MAPIFreeBuffer@4 MAPIGetDefaultMalloc@0 MAPIInitIdle MAPIInitialize MAPIInitialize@4 MAPILogoff MAPILogon MAPILogonEx MAPILogonEx@20 MAPIOpenFormMgr MAPIOpenFormMgr@8 MAPIOpenLocalFormContainer MAPIOpenLocalFormContainer@4 MAPIReadMail MAPIResolveName MAPISaveMail MAPISendDocuments MAPISendMail MAPISendMailW MAPIUninitialize MAPIUninitialize@0 MNLS_CompareStringW@24 MNLS_IsBadStringPtrW@8 MNLS_MultiByteToWideChar@24 MNLS_WideCharToMultiByte@32 MNLS_lstrcmpW@8 MNLS_lstrcpyW@8 MNLS_lstrlenW@4 MapStorageSCode OpenIMsgOnIStg OpenIMsgSession OpenStreamOnFile OpenStreamOnFile@24 OpenTnefStream OpenTnefStream@28 OpenTnefStreamEx OpenTnefStreamEx@32 PRProviderInit PpropFindProp@12 PropCopyMore@16 RTFSync RTFSync@12 ScBinFromHexBounded ScCopyNotifications ScCopyProps@16 ScCountNotifications ScCountProps@12 ScCreateConversationIndex ScDupPropset@16 ScGenerateMuid ScInitMapiUtil@4 ScLocalPathFromUNC ScMAPIXFromCMC ScMAPIXFromSMAPI ScRelocNotifications ScRelocProps@20 ScUNCFromLocalPath SetAttribIMsgOnIStg SwapPlong@8 SwapPword@8 SzFindCh@8 SzFindLastCh@8 SzFindSz@8 UFromSz@4 UNKOBJ_COFree UNKOBJ_Free UNKOBJ_FreeRows UNKOBJ_ScAllocate UNKOBJ_ScAllocateMore UNKOBJ_ScCOAllocate UNKOBJ_ScCOReallocate UNKOBJ_ScSzFromIdsAlloc UlAddRef@4 UlFromSzHex@4 UlPropSize@4 UlRelease@4 WrapCompressedRTFStream WrapCompressedRTFStream@12 WrapProgress@20 WrapStoreEntryID __CPPValidateParameters __ValidateParameters cmc_act_on cmc_free cmc_list cmc_logoff cmc_logon cmc_look_up cmc_query_configuration cmc_read cmc_send cmc_send_documents mapi32_8

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a4d9351395488df6861ec25516f286745bb82dc231135b4f13f21ec9e976a60a

ntdll

advapi32

kernel32

msvcrt

shlwapi

user32

generic