13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688

Sharing

Copy URL Twitter E-mail

General

Target
13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688
Size 189KB
Sample260916-yscp5avfjf
SHA256 13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688
MD5 8f49897e9ead1961cd4703d2f738c0cf
SHA1 70426488b075626612510f13bcb51534c553cfa5
SHA512 3deb7d86ddd4e4d14b7062218b80246ebb9ea8e3636b8409a25226c5e17190906f0d11cfd2c732515891a9fc5cf5a37c9f115cefd35d5ca955469642db57d125
SSDEEP 3072:nR29juSL4jJ6VkgrVQ71u5AOYe+wcTHKKE8ZIv8Z7Rf/vbpS2egfEeb7s:RC6SLAJ6VkgrVQ71u5AdwcTHKkG+7RfX
TLSH
T1CE147C06A981D872D46791785979A7A6DA3C38324739A0C3F390BD793E642D1BE3C31F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688

File Explorer

13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688

.exe 189KB

13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688

IMPHASH ad8cfaedfc9fbc8b4528ded802c9cbd0
SHA256 13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688
MD5 8f49897e9ead1961cd4703d2f738c0cf
SHA1 70426488b075626612510f13bcb51534c553cfa5
SHA512 3deb7d86ddd4e4d14b7062218b80246ebb9ea8e3636b8409a25226c5e17190906f0d11cfd2c732515891a9fc5cf5a37c9f115cefd35d5ca955469642db57d125
SSDEEP 3072:nR29juSL4jJ6VkgrVQ71u5AOYe+wcTHKKE8ZIv8Z7Rf/vbpS2egfEeb7s:RC6SLAJ6VkgrVQ71u5AdwcTHKkG+7RfX
TLSH
T1CE147C06A981D872D46791785979A7A6DA3C38324739A0C3F390BD793E642D1BE3C31F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

83950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile ReadFile CreateMailslotA SetEvent CreateEventA GetCurrentProcessId GlobalLock GlobalUnlock LoadLibraryA GetLogicalDrives GetDiskFreeSpaceExA CompareStringW GetStringTypeW HeapSize GetTimeZoneInformation GetProcessHeap SetEndOfFile FlushFileBuffers WriteConsoleW IsProcessorFeaturePresent SetStdHandle QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW CreatePipe GetFileAttributesA LCMapStringW CreateFileA GetOEMCP GetACP GetComputerNameA GetFileTime GetDriveTypeA SetFileTime GetTickCount OpenFile IsDebuggerPresent GetSystemTime GetLocalTime LocalFree GetVersionExA GetModuleHandleA GlobalMemoryStatusEx GlobalFree GetProcAddress GetLastError GlobalAlloc GetCurrentProcess CreateThread CreateToolhelp32Snapshot GetModuleFileNameA Process32Next TerminateProcess CreateProcessA TerminateThread OpenProcess WaitForSingleObject Process32First SetErrorMode EndUpdateResourceA EnumResourceNamesA LoadLibraryExA BeginUpdateResourceA LockResource GetBinaryTypeA UpdateResourceA LoadResource FreeLibrary FreeResource FindResourceA OpenFileMappingA CloseHandle UnmapViewOfFile MapViewOfFile GetCPInfo LoadLibraryW CreateFileW InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleFileNameW HeapCreate GetCurrentDirectoryW PeekNamedPipe GetFileInformationByHandle SetFilePointer DeleteCriticalSection GetFileType GetStdHandle SetHandleCount GetConsoleMode GetConsoleCP WideCharToMultiByte IsValidCodePage SetFileAttributesA RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection EncodePointer SetUnhandledExceptionFilter UnhandledExceptionFilter GetStartupInfoW HeapSetInformation GetCommandLineA DuplicateHandle GetFullPathNameA GetDriveTypeW SetCurrentDirectoryA GetCurrentDirectoryA SetEnvironmentVariableA CreateDirectoryA GetSystemTimeAsFileTime FindClose FileTimeToSystemTime FileTimeToLocalFileTime FindFirstFileExA HeapFree HeapAlloc HeapReAlloc DeleteFileA GetModuleHandleW ExitProcess DecodePointer Sleep MultiByteToWideChar FindNextFileA

user32

GetWindowThreadProcessId GetKeyboardLayout GetWindowTextA GetForegroundWindow CallNextHookEx GetKeyState UnhookWindowsHookEx DispatchMessageA SetWindowsHookExA EmptyClipboard CloseClipboard ReleaseDC GetDC MessageBoxA IsWindowVisible TranslateMessage GetDesktopWindow EnumWindows GetWindowRect SetClipboardData OpenClipboard GetMessageA GetClipboardData

gdi32

CreateCompatibleBitmap CreateDIBSection BitBlt DeleteDC DeleteObject SelectObject CreateCompatibleDC

advapi32

FreeSid RegEnumKeyA RegOpenKeyA LookupAccountSidW ConvertStringSidToSidA OpenSCManagerA StartServiceA CreateServiceA ChangeServiceConfig2A DeleteService CloseServiceHandle OpenServiceA SetServiceStatus RegisterServiceCtrlHandlerA StartServiceCtrlDispatcherA CryptHashData CryptDestroyHash CryptCreateHash CryptAcquireContextA CryptReleaseContext CryptGetHashParam CheckTokenMembership SetSecurityDescriptorDacl AllocateAndInitializeSid GetTokenInformation ConvertSidToStringSidA OpenProcessToken RegCloseKey RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA ConvertStringSecurityDescriptorToSecurityDescriptorA SetKernelObjectSecurity InitializeSecurityDescriptor

shell32

ShellExecuteA

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

VariantClear VariantInit

shlwapi

SHDeleteKeyA

wininet

InternetReadFile HttpOpenRequestA InternetGetConnectedState HttpSendRequestA InternetOpenA InternetCloseHandle InternetConnectA

winmm

mciSendStringA

wsock32

recv htons WSAStartup connect send gethostbyname closesocket socket

iphlpapi

GetAdaptersInfo

gdiplus

GdiplusStartup GdipSaveImageToFile GdiplusShutdown GdipGetImageEncodersSize GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncoders

mpr

WNetCloseEnum WNetOpenEnumA WNetEnumResourceA

netapi32

NetUserAdd NetLocalGroupAddMembers

Sharing

General

Malware Config

Signatures

File Explorer

13e4df7d12c4aef759900c54499efc5f2f4aa77f48cfb19dae25fa0058c3d688

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

winmm

wsock32

iphlpapi

gdiplus

mpr

netapi32

generic