26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca

Sharing

Copy URL Twitter E-mail

General

Target
26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca
Size 1.6MB
Sample260919-m2kljsed56
SHA256 26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca
MD5 7ce403241cae718c1ab3ee9ebea49293
SHA1 5a2a1c4abad3478387a6f1a368a9320fd7dec0b8
SHA512 7d74757105df8084d67d223ecf57cb9d20827dbfa7c8424b8793da2b22737eceb20421cd37449da9e22dc01eb05a975701f2a1864ccc534c56e146e2597bcbe5
SSDEEP 24576:WoRLRYFQImLmGqC0maH4xPjPPe1YzyXIG5a3:WKLRY6ImL9qC0wCAyXIGC
TLSH
T15C759E5A629402F9F4B7D239CA564A65EF72BC094320E6CB13E476E51F177E04B3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca

File Explorer

26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca

.exe 1.6MB

26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca

IMPHASH 308dbb0840ee593e5d16a87b841cefe8
SHA256 26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca
MD5 7ce403241cae718c1ab3ee9ebea49293
SHA1 5a2a1c4abad3478387a6f1a368a9320fd7dec0b8
SHA512 7d74757105df8084d67d223ecf57cb9d20827dbfa7c8424b8793da2b22737eceb20421cd37449da9e22dc01eb05a975701f2a1864ccc534c56e146e2597bcbe5
SSDEEP 24576:WoRLRYFQImLmGqC0maH4xPjPPe1YzyXIG5a3:WKLRY6ImL9qC0wCAyXIGC
TLSH
T15C759E5A629402F9F4B7D239CA564A65EF72BC094320E6CB13E476E51F177E04B3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

525936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\A147\installer\Build\x64\UnicodeRelease\SamanLauncher\SamanLauncher.pdb

kernel32

GetModuleHandleW GetProcAddress LoadLibraryExW LocalFree FormatMessageW MoveFileW MoveFileExW MultiByteToWideChar VerSetConditionMask GetStdHandle GetEnvironmentVariableW GetCurrentDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFinalPathNameByHandleW GetLogicalDriveStringsW QueryDosDeviceW RemoveDirectoryW SetFileAttributesW DecodePointer InitializeCriticalSectionEx DeleteCriticalSection CreateMutexW GetCurrentProcessId TerminateProcess GetCurrentThreadId GetSystemDirectoryW GetVersionExW GetModuleFileNameW OpenProcess LockResource SizeofResource FindResourceW lstrlenW VerifyVersionInfoW WideCharToMultiByte AllocConsole CreateToolhelp32Snapshot Process32FirstW Process32NextW K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessImageFileNameW WaitForMultipleObjects SetDllDirectoryW GetUserDefaultUILanguage HeapAlloc GetProcessHeap CreateDirectoryW LocalFileTimeToFileTime ReadFile SetFilePointer SetFileTime SystemTimeToFileTime LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetEndOfFile HeapSize SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW CreateProcessW GetExitCodeProcess GetCurrentProcess Sleep CreateEventW WaitForSingleObject SetEvent WaitNamedPipeW SetNamedPipeHandleState GetLastError CloseHandle WriteFile LoadResource CreateFileW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetConsoleCtrlHandler HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode RtlUnwind GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW HeapFree GetCurrentThread FormatMessageA EnterCriticalSection LeaveCriticalSection GetLocaleInfoEx EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary SetStdHandle GetFileType GetTimeZoneInformation ExitProcess GetModuleHandleExW

user32

MessageBoxW GetSystemMetrics MessageBoxIndirectW EnumWindows UnregisterClassW SendMessageW GetWindowThreadProcessId GetShellWindow

advapi32

GetUserNameW RegSetValueExW RegOpenKeyExW RegCloseKey GetTokenInformation FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid LookupPrivilegeValueW DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteW SHGetSpecialFolderLocation SHCreateDirectoryExW SHGetSpecialFolderPathW SHChangeNotify

ole32

CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoInitializeSecurity CoCreateGuid CoUninitialize CoInitialize

oleaut32

SysAllocString VariantClear SysFreeString CreateErrorInfo GetErrorInfo VariantChangeType SetErrorInfo VariantInit

shlwapi

PathFileExistsW PathFindExtensionW PathIsNetworkPathW PathIsDirectoryW PathFindFileNameW PathIsRelativeW SHDeleteKeyW SHDeleteValueW StrStrIW SHGetValueW SHSetValueW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

26bd0947823772d21f900a5e0c5a9225e06153dd5c2c682632b13e83acd6d3ca

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic