7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad

Sharing

Copy URL Twitter E-mail

General

Target
7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad
Size 1.2MB
Sample260916-pxalwsythy
SHA256 7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad
MD5 95c41767f9192deb049d2ebe5310f7d2
SHA1 9a18aa204f854d71fe478b6a63d943e5ad0badf3
SHA512 c0a2667a6265b9bc52b422550dafe20a01fcb7670c4fa5c3947fbdbd6fafc7fdf79588252cea1bc82f1cd8a93aab18ee0b9b1339b02107ff724d07d6c1f28902
SSDEEP 24576:BV/uDfIfP43TSYW3zt5Fw/InZ39q2x2GI9qA5iME88NymfCg2eu:BV/uDwfSTIJ0gnZ39q2x2GI9qSIJdx2e
TLSH
T12655AF25A7B841B8D1BBC1B8C5574607EBB274590330A7DF17E48AAA2F23BE1573E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad

File Explorer

7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad

.dll 1.2MB

7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad

IMPHASH 94197ffc9ed70acb13a960a963aa937a
SHA256 7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad
MD5 95c41767f9192deb049d2ebe5310f7d2
SHA1 9a18aa204f854d71fe478b6a63d943e5ad0badf3
SHA512 c0a2667a6265b9bc52b422550dafe20a01fcb7670c4fa5c3947fbdbd6fafc7fdf79588252cea1bc82f1cd8a93aab18ee0b9b1339b02107ff724d07d6c1f28902
SSDEEP 24576:BV/uDfIfP43TSYW3zt5Fw/InZ39q2x2GI9qA5iME88NymfCg2eu:BV/uDwfSTIJ0gnZ39q2x2GI9qSIJdx2e
TLSH
T12655AF25A7B841B8D1BBC1B8C5574607EBB274590330A7DF17E48AAA2F23BE1573E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

713872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

bcrypt

BCryptGenRandom

advapi32

CryptCreateHash RegQueryValueExW RegCloseKey RegEnumKeyA RegOpenKeyExA RegQueryValueExA SystemFunction036 CryptAcquireContextW CryptReleaseContext CryptGetHashParam RegGetValueW CryptHashData CryptDestroyHash EventRegister EventSetInformation EventWriteTransfer EventUnregister RegOpenKeyExW

crypt32

CertGetCertificateChain CertFreeCertificateChain CryptUnprotectData CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertFreeCRLContext CertAddCertificateContextToStore CertFreeCTLContext CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine

secur32

InitSecurityInterfaceW

ws2_32

WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent send getsockopt WSAWaitForMultipleEvents ioctlsocket freeaddrinfo getaddrinfo listen htonl select __WSAFDIsSet WSAIoctl WSASetLastError setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup ntohs socket htons WSAGetLastError closesocket WSAResetEvent

iphlpapi

if_nametoindex

kernel32

HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage DeleteFileW GetTimeZoneInformation SetEndOfFile SetStdHandle HeapReAlloc ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapAlloc WriteConsoleW OutputDebugStringW ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetFileType GetFinalPathNameByHandleW GetTempPathW GetTempPathA GetTempFileNameA ContinueDebugEvent WaitForDebugEvent DebugActiveProcessStop CloseHandle DuplicateHandle Sleep GetCurrentProcess ExitProcess TerminateProcess OpenThread CreateProcessW GetThreadContext SetThreadContext OpenProcess GetSystemTimeAsFileTime ReadProcessMemory GetModuleFileNameA GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LocalFree QueryFullProcessImageNameA CopyFileA MultiByteToWideChar WideCharToMultiByte AllocConsole CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualProtect InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateFileW GetFullPathNameW MoveFileExW FormatMessageW InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceFrequency SleepEx QueryPerformanceCounter GetTickCount WaitForSingleObjectEx CreateThread GetEnvironmentVariableA VerSetConditionMask VerifyVersionInfoW GetFileSizeEx ReadFile GetFileAttributesW OutputDebugStringA RtlUnwind GetModuleFileNameW GetProcessHeap HeapFree LoadLibraryExW LoadLibraryW FreeLibrary GetEnvironmentVariableW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer AreFileApisANSI GetSystemTimePreciseAsFileTime FormatMessageA GetLocaleInfoEx GetCurrentThreadId TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentDirectoryW FindFirstFileExW FindNextFileW

user32

TranslateMessage DispatchMessageW SendMessageA GetMessageW ToUnicodeEx GetKeyboardLayout DefWindowProcW SetWinEventHook CreateIconFromResourceEx CallNextHookEx SetWindowsHookExW GetWindowThreadProcessId FindWindowExW SetWindowLongPtrA GetWindowLongPtrA GetClientRect GetWindowTextW SetWindowTextW SetForegroundWindow GetForegroundWindow GetSystemMetrics GetAsyncKeyState GetKeyState ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassW PostQuitMessage

shell32

SHGetPropertyStoreForWindow

ole32

CoTaskMemAlloc CoTaskMemFree PropVariantClear CoCreateGuid CoInitializeEx CoUninitialize

dwmapi

DwmSetWindowAttribute

Name

.text

Size

892KB

Virtual Size

892KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

293KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7fa02f132fd7cf921cc86b7f6e89fccbdb8001871b98e988c8a974f5986a24ad

bcrypt

advapi32

crypt32

secur32

ws2_32

iphlpapi

kernel32

user32

shell32

ole32

dwmapi

generic