bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5

Sharing

Copy URL Twitter E-mail

General

Target
bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5
Size 316KB
Sample260916-mkr93ayfne
SHA256 bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5
MD5 30b046f618547d580eb9427be3abca9a
SHA1 f73f88f9294f50de3a454b08d9455671ea736670
SHA512 f5fefa61145531575f63fc0453045ae8fb41c883304b47fc7eb14832c0093de194f952a0dda893c193003f35666c5f8510ec1e2da492aceeb900227b0f6fae38
SSDEEP 3072:COAb5HfPB7OEge25APbrXdImFsDWr4B7tWaRfRTn279nWFaD5jz/emeL0ppQ86w:Bu5HXB7OEgYPfdQargtjTn0WYPPR
TLSH
T17D647C7AB39544EAF47A81344FBAB632F639BC418E61FAAF2A60C5391C74761F440F05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5

File Explorer

bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5

.dll 316KB

bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5

IMPHASH 52656e11e8add369d784e0f86f24c283
SHA256 bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5
MD5 30b046f618547d580eb9427be3abca9a
SHA1 f73f88f9294f50de3a454b08d9455671ea736670
SHA512 f5fefa61145531575f63fc0453045ae8fb41c883304b47fc7eb14832c0093de194f952a0dda893c193003f35666c5f8510ec1e2da492aceeb900227b0f6fae38
SSDEEP 3072:COAb5HfPB7OEge25APbrXdImFsDWr4B7tWaRfRTn279nWFaD5jz/emeL0ppQ86w:Bu5HXB7OEgYPfdQargtjTn0WYPPR
TLSH
T17D647C7AB39544EAF47A81344FBAB632F639BC418E61FAAF2A60C5391C74761F440F05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyW RegQueryValueA RegQueryValueW

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MulDiv MultiByteToWideChar SizeofResource WideCharToMultiByte lstrcmpW

msacm32

acmFormatChooseW acmFormatDetailsW acmFormatSuggest acmFormatTagDetailsW acmMetrics acmStreamClose acmStreamConvert acmStreamOpen acmStreamPrepareHeader acmStreamSize acmStreamUnprepareHeader

msvfw32

ICClose ICCompress ICCompressorChoose ICCompressorFree ICDecompress ICGetDisplayFormat ICGetInfo ICLocate ICOpen ICSendMessage

ntdll

_vsnprintf

ole32

CoCreateInstance CoTaskMemAlloc OleInitialize

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _assert _recalloc _strdup calloc free fwrite getenv malloc memcmp memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen wcslen wcsrchr

user32

CheckDlgButton DialogBoxParamW EnableWindow EndDialog GetDlgItem GetDlgItemInt IsDlgButtonChecked LoadStringW SendDlgItemMessageW SendMessageW SetDlgItemInt SetDlgItemTextW wsprintfA wsprintfW

winmm

mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioOpenA mmioOpenW mmioRead mmioSeek mmioWrite

AVIBuildFilter AVIBuildFilterA AVIBuildFilterW AVIClearClipboard AVIFileAddRef AVIFileCreateStream AVIFileCreateStreamA AVIFileCreateStreamW AVIFileEndRecord AVIFileExit AVIFileGetStream AVIFileInfo AVIFileInfoA AVIFileInfoW AVIFileInit AVIFileOpen AVIFileOpenA AVIFileOpenW AVIFileReadData AVIFileRelease AVIFileWriteData AVIGetFromClipboard AVIMakeCompressedStream AVIMakeFileFromStreams AVIMakeStreamFromClipboard AVIPutFileOnClipboard AVISave AVISaveA AVISaveOptions AVISaveOptionsFree AVISaveV AVISaveVA AVISaveVW AVISaveW AVIStreamAddRef AVIStreamBeginStreaming AVIStreamCreate AVIStreamEndStreaming AVIStreamFindSample AVIStreamGetFrame AVIStreamGetFrameClose AVIStreamGetFrameOpen AVIStreamInfo AVIStreamInfoA AVIStreamInfoW AVIStreamLength AVIStreamOpenFromFile AVIStreamOpenFromFileA AVIStreamOpenFromFileW AVIStreamRead AVIStreamReadData AVIStreamReadFormat AVIStreamRelease AVIStreamSampleToTime AVIStreamSetFormat AVIStreamStart AVIStreamTimeToSample AVIStreamWrite AVIStreamWriteData CLSID_AVISimpleUnMarshal CreateEditableStream DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer EditStreamClone EditStreamCopy EditStreamCut EditStreamPaste EditStreamSetInfo EditStreamSetInfoA EditStreamSetInfoW EditStreamSetName EditStreamSetNameA EditStreamSetNameW IID_IAVIEditStream IID_IAVIFile IID_IAVIStream IID_IGetFrame

Name

.text

Size

148KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bff07ede3b1503e52e10a23e91b4c90ccaa4062b912a8a32fb16197b5ac383b5

advapi32

kernel32

msacm32

msvfw32

ntdll

ole32

rpcrt4

ucrtbase

user32

winmm

generic