3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a

Sharing

Copy URL Twitter E-mail

General

Target
3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a
Size 849KB
Sample260919-xrdelaba35
SHA256 3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a
MD5 6f627a775bbb76377355e7c23fc4501a
SHA1 989f9770efb095e4f839cb5ecc8a736467af286a
SHA512 2af6f423228f44c664f656b26562d82a29b2c7adfe7f036ee6919b3419e207705a28b991a1c1c6821a30ee16a0274d46117ca5f70739f4b4509d3a77f17fca3b
SSDEEP 6144:yrgAKEWE2nUPK5ALYbhh2RPlXFXp+4rLdrRl9gmvdaqe7hUG365Ig4jmdTwcEh19:HAKEOhqFNXte6Io73z
TLSH
T162057001ABF99A56F6F77F7069B612A14D3BBC51AF35C60E5225904E4C31E60CEA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a

File Explorer

3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a

.dll 849KB

3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a

IMPHASH 850fac39e3da623bb562ae192b2be73e
SHA256 3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a
MD5 6f627a775bbb76377355e7c23fc4501a
SHA1 989f9770efb095e4f839cb5ecc8a736467af286a
SHA512 2af6f423228f44c664f656b26562d82a29b2c7adfe7f036ee6919b3419e207705a28b991a1c1c6821a30ee16a0274d46117ca5f70739f4b4509d3a77f17fca3b
SSDEEP 6144:yrgAKEWE2nUPK5ALYbhh2RPlXFXp+4rLdrRl9gmvdaqe7hUG365Ig4jmdTwcEh19:HAKEOhqFNXte6Io73z
TLSH
T162057001ABF99A56F6F77F7069B612A14D3BBC51AF35C60E5225904E4C31E60CEA0B33
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

vDbgPrintExWithPrefix

advapi32

RegCloseKey RegDeleteKeyW RegOpenKeyExW RegQueryValueExW

comctl32

ImageList_Add InitCommonControlsEx

kernel32

CloseHandle CreateSemaphoreW DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindResourceW FormatMessageW FreeLibrary GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentVariableA GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTickCount GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection LeaveCriticalSection LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LocalReAlloc LockResource MultiByteToWideChar QueryPerformanceCounter ReleaseSemaphore SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte

msvcrt

__dllonexit _amsg_exit _beginthreadex _initterm _iob _lock _onexit _unlock _vsnprintf _wcsicmp _wcsnicmp _wtoi abort bsearch calloc free fwrite malloc memcmp memcpy memmove sprintf strchr strcmp strcpy strcspn strncmp swprintf vfprintf wcscat wcschr wcscmp wcscpy wcslen wcsncpy wcstoul

newdev

InstallDevInst

ole32

CLSIDFromString CoCreateInstance StringFromGUID2

setupapi

CM_Connect_MachineW CM_Disconnect_Machine CM_Enumerate_Classes CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Registry_Property_ExW CM_Get_DevNode_Status_Ex CM_Get_Device_IDW CM_Get_Device_ID_List_ExW CM_Get_Device_ID_List_Size_ExW CM_Get_Device_ID_Size CM_Get_HW_Prof_Flags_ExW CM_Get_Parent_Ex CM_Get_Sibling CM_Locate_DevNodeW SetupCloseFileQueue SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiChangeState SetupDiClassNameFromGuidW SetupDiCreateDeviceInfoListExW SetupDiDestroyClassImageList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupDiGetClassDescriptionW SetupDiGetClassDevPropertySheetsW SetupDiGetClassDevsW SetupDiGetClassImageIndex SetupDiGetClassImageList SetupDiGetDeviceInstallParamsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiLoadClassIcon SetupDiOpenClassRegKey SetupDiOpenClassRegKeyExW SetupDiOpenDevRegKey SetupDiOpenDeviceInfoW SetupDiSetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetSelectedDriverW SetupOpenFileQueue SetupScanFileQueueW pSetupGuidFromString

shell32

ShellAboutW

uxtheme

SetWindowTheme

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

gdi32

DeleteObject

user32

AppendMenuW BeginDeferWindowPos CallWindowProcW CheckMenuItem CheckMenuRadioItem CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DeferWindowPos DeleteMenu DestroyIcon DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW EmptyClipboard EnableMenuItem EnableWindow EndDeferWindowPos EndDialog GetAncestor GetClientRect GetCursorPos GetDlgItem GetMenu GetMenuItemCount GetMenuItemRect GetMenuState GetMessageW GetParent GetPropW GetSubMenu GetSystemMetrics GetWindowLongW GetWindowRect GetWindowTextLengthW InsertMenuItemW IsWindowVisible KillTimer LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxW OpenClipboard PostMessageW PostQuitMessage PtInRect RegisterClassExW RemovePropW ScreenToClient SendDlgItemMessageW SendMessageW SetClipboardData SetDlgItemTextW SetFocus SetMenuDefaultItem SetPropW SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TrackPopupMenu TrackPopupMenuEx TranslateMessage UnregisterClassW wsprintfW

Name

.text

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

815B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

494KB

Virtual Size

494KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

198KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3582dda7d1fc7c55ecd89a034ed37a71bfb31944003284f8ff81d76634430d1a

ntdll

advapi32

comctl32

kernel32

msvcrt

newdev

ole32

setupapi

shell32

uxtheme

version

gdi32

user32

generic