7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0

Sharing

Copy URL Twitter E-mail

General

Target
7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0
Size 3.8MB
Sample260916-pdgwvsar91
SHA256 7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0
MD5 6506104196fe6c280d0819735eec95f2
SHA1 81eb084849f96621d2da30afdd36da397cf5b9aa
SHA512 98af3687afd08a30b0c0c8c1a1d8576bcc8c01f2f16bd46b82f5b1c6d72e8bfc1971149eae8b9b1ebc0e0bbe0d28cbcc224d0622f5dc03781890a43b0142928e
SSDEEP 49152:U97Ij2syydR14f7lydCCKPOJLo7FIy0cGrEoloxRFG2GLDbH/kAhp3I3kFUCQxAm:UPfOpkIbrkxO2GL/fkAMU
TLSH
T1AA068E2293505109FEF711B7D6FED92E8E2C666283381CC7618C29AED764ED13932B53
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0

File Explorer

7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0

.dll 3.8MB

7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0

IMPHASH deb61ddc2b02a3b1c08a543a3758355e
SHA256 7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0
MD5 6506104196fe6c280d0819735eec95f2
SHA1 81eb084849f96621d2da30afdd36da397cf5b9aa
SHA512 98af3687afd08a30b0c0c8c1a1d8576bcc8c01f2f16bd46b82f5b1c6d72e8bfc1971149eae8b9b1ebc0e0bbe0d28cbcc224d0622f5dc03781890a43b0142928e
SSDEEP 49152:U97Ij2syydR14f7lydCCKPOJLo7FIy0cGrEoloxRFG2GLDbH/kAhp3I3kFUCQxAm:UPfOpkIbrkxO2GL/fkAMU
TLSH
T1AA068E2293505109FEF711B7D6FED92E8E2C666283381CC7618C29AED764ED13932B53
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32916

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

G:\New folder\bin\Debug\debug.pdb

kernel32

VirtualProtect VirtualQuery GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency CreateThread DisableThreadLibraryCalls FreeLibraryAndExitThread AllocConsole FreeConsole GetConsoleWindow VirtualAlloc VirtualFree CloseHandle HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext GetModuleHandleW FlushInstructionCache CreateToolhelp32Snapshot Thread32First Thread32Next GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap ReadFile GetFileSizeEx CreateFileA OutputDebugStringA InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive FreeLibrary Sleep GetProcAddress SetThreadContext GetModuleHandleA

user32

PostMessageA LoadCursorA SetWindowLongA CallWindowProcA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow ReleaseCapture SetCapture GetCapture GetKeyState IsChild EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard MessageBoxA

msvcp140d

?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ _Mtx_lock _Mtx_trylock _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ??0_Lockit@std@@QAE@H@Z ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ??1_Lockit@std@@QAE@XZ ??Bid@locale@std@@QAEIXZ

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext

xinput1_3

ord2 ord4

vcruntime140d

__vcrt_LoadLibraryExW __vcrt_GetModuleFileNameW _setjmp3 longjmp strrchr __std_type_info_destroy_list _except_handler4_common __current_exception_context __current_exception strchr __RTDynamicCast strstr memcmp memset memchr _purecall __CxxFrameHandler3 _CxxThrowException __std_exception_destroy __std_exception_copy memmove memcpy __vcrt_GetModuleHandleW

ucrtbased

_unlock_file wcslen cos ceil toupper atan2 roundf strcmp abs floor __stdio_common_vsprintf strcpy log __stdio_common_vsprintf_s _fdtest acos atan strtok_s _strdup free strtol strlen strncpy __acrt_iob_func _wfopen fseek ftell __stdio_common_vfprintf __stdio_common_vsscanf malloc qsort atof isprint freopen_s strcpy_s rand atoi strncpy_s _stricmp realloc strtod strtoul strncmp isspace tolower __stdio_common_vsnprintf_s _lock_file _free_dbg _malloc_dbg terminate _callnewh _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _cexit _aligned_malloc _except1 _initterm _initterm_e _aligned_free strcat getenv exit _CrtDbgReportW strcat_s _wmakepath_s _wsplitpath_s wcscpy_s ungetc _fseeki64 fsetpos fread fputc fgetpos fgetc fflush fclose _get_stream_buffer_pointers fmaxf remainder pow sin fmod exp _wassert sqrt fabs _CrtDbgReport _invalid_parameter setvbuf isdigit fwrite fminf

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

754KB

Virtual Size

754KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

225KB

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7c243d0b2913a9b32877f57f52a3530bf7a940152c8031b3c9fc81f7c28b20e0

kernel32

user32

msvcp140d

imm32

xinput1_3

vcruntime140d

ucrtbased

generic