bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

Sharing

Copy URL Twitter E-mail

General

Target
bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816
Size 557KB
Sample260919-snytxasdnd
SHA256 bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816
MD5 8489fb9bcdf17b48895aee0acf3ae2ae
SHA1 e43cfb115fc54f4d0609c3143e52df945babcc52
SHA512 99557211214423c1e50162fbea60eca07534d7fb6a28e5bf2a3534479aab1c19030b0786cda2dc921e8e186366886d48c0939eedc12ef619eeafdbe98563cd82
SSDEEP 12288:yBrK643BsHfwZXr5a95ujyPAQYiE2LaAe0gO1VcGarHDF:8rmK/wZX1a+yHA2Lle0gOItF
TLSH
T16FC44B03F7E321FCE1B7D5309AB75632B972785019346E3E4190DA362E71E51AA38F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

File Explorer

bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

.exe 557KB

bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

IMPHASH 80e96812bf9cdb9e1fb9eff52a4da8e7
SHA256 bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816
MD5 8489fb9bcdf17b48895aee0acf3ae2ae
SHA1 e43cfb115fc54f4d0609c3143e52df945babcc52
SHA512 99557211214423c1e50162fbea60eca07534d7fb6a28e5bf2a3534479aab1c19030b0786cda2dc921e8e186366886d48c0939eedc12ef619eeafdbe98563cd82
SSDEEP 12288:yBrK643BsHfwZXr5a95ujyPAQYiE2LaAe0gO1VcGarHDF:8rmK/wZX1a+yHA2Lle0gOItF
TLSH
T16FC44B03F7E321FCE1B7D5309AB75632B972785019346E3E4190DA362E71E51AA38F26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges CloseServiceHandle LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW SystemFunction036

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_GetIcon ImageList_GetImageCount ImageList_ReplaceIcon ImageList_SetOverlayImage InitCommonControlsEx

comdlg32

GetSaveFileNameW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MoveToEx Polyline SelectObject SetBkColor SetBkMode SetTextColor

iphlpapi

GetAdaptersAddresses

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreatePipe CreateProcessW CreateSemaphoreA DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitThread FindClose FindFirstFileW FindNextFileW FreeLibrary GetCPInfo GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessAffinityMask GetProcessHeap GetShortPathNameW GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocalReAlloc MapViewOfFile MulDiv MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ResetEvent ResumeThread SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrcatW lstrcmpW lstrcmpiW lstrcpynW lstrlenW

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _close _commode _endthreadex _errno _fileno _fmode _initterm _lseek _open _read _setjmp _setmode _strcmpi _strnicmp _strdup _vscprintf _vsnprintf _vsnwprintf _wcsicmp _wcsicmp _wcsnicmp _wcsnicmp _wopen _write _write _wtoi atexit abort calloc exit fflush fprintf free longjmp malloc memchr memcmp memcpy memmove memset qsort realloc setvbuf signal strlen strncmp strstr swprintf_s swscanf_s towlower vfprintf wcschr wcscmp wcscpy wcscpy_s wcslen wcsncmp wcsrchr wcsstr wcstol

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

setupapi

CM_Disable_DevNode CM_Enable_DevNode CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key CM_Reenumerate_DevNode SetupCloseInfFile SetupCopyOEMInfW SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiDestroyClassImageList SetupDiDestroyDeviceInfoList SetupDiDestroyDriverInfoList SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupDiGetClassDescriptionW SetupDiGetClassDevsW SetupDiGetClassImageIndex SetupDiGetClassImageList SetupDiGetDeviceInstallParamsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetINFClassW SetupDiInstallDevice SetupDiLoadDeviceIcon SetupDiOpenDeviceInfoW SetupDiRemoveDevice SetupDiSetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetSelectedDriverW SetupFindFirstLineW SetupGetStringFieldW SetupOpenInfFileW SetupUninstallOEMInfW

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW ExtractIconExW SHBrowseForFolderW SHCreateShellItem SHFileOperationW SHGetPathFromIDListW SHParseDisplayName ShellExecuteW StrStrIW

shlwapi

PathFindExtensionW PathIsDirectoryW PathMatchSpecW SHLoadIndirectString

user32

AppendMenuW BeginPaint CallWindowProcW ChangeWindowMessageFilterEx ClientToScreen CloseClipboard CopyImage CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW DrawFrameControl DrawTextW EmptyClipboard EnableWindow EndDialog EndPaint EnumChildWindows FillRect FindWindowExW FrameRect GetAncestor GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetDlgItemTextW GetMessagePos GetMessageW GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindow GetWindowDC GetWindowLongPtrW GetWindowRect GetWindowTextW InflateRect InsertMenuItemW InvalidateRect IsDialogMessageW IsDlgButtonChecked IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW LockWindowUpdate MapWindowPoints MessageBoxW OffsetRect OpenClipboard PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassW RegisterDeviceNotificationW ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendDlgItemMessageW SendMessageTimeoutW SendMessageW SetCapture SetClipboardData SetDlgItemTextW SetForegroundWindow SetMenuInfo SetProcessDPIAware SetPropW SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UnregisterDeviceNotification UpdateWindow wsprintfW

uxtheme

SetWindowTheme

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

381KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

400B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

advapi32

comctl32

comdlg32

gdi32

iphlpapi

kernel32

msvcrt

ole32

setupapi

shell32

shlwapi

user32

uxtheme

version

generic