eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df

Sharing

Copy URL Twitter E-mail

General

Target
eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df
Size 1.1MB
Sample260921-a6767awtbx
SHA256 eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df
MD5 55b97b7d4e76a68bbc839ebe74c75be2
SHA1 19b1690ee2f3482e00b58fe5d54b8d0f161eb63e
SHA512 0678f4cf948d102f77896b7f0a517d92c896b29a5376606cc39df8918d78680cc5af6d418341bd9a9042808b3acb4f5a49d9a5427ba196220e294c981f13ccac
SSDEEP 24576:f1PghBzKWN1zjpjLJ1RxfawZzZA2UDF/WYVO0d5:fVax1zBLnf7ZA2UDgYE0b
TLSH
T12A35291AEA31F694C26A903E5442996FD6B379144BF083DF83508B1E4F2BBD05B3E356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df

File Explorer

eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df

.dll 1.1MB

eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df

IMPHASH a62a4e55e145a922e3a860d82c01e587
SHA256 eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df
MD5 55b97b7d4e76a68bbc839ebe74c75be2
SHA1 19b1690ee2f3482e00b58fe5d54b8d0f161eb63e
SHA512 0678f4cf948d102f77896b7f0a517d92c896b29a5376606cc39df8918d78680cc5af6d418341bd9a9042808b3acb4f5a49d9a5427ba196220e294c981f13ccac
SSDEEP 24576:f1PghBzKWN1zjpjLJ1RxfawZzZA2UDF/WYVO0d5:fVax1zBLnf7ZA2UDgYE0b
TLSH
T12A35291AEA31F694C26A903E5442996FD6B379144BF083DF83508B1E4F2BBD05B3E356
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

376044

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

RtlLookupFunctionEntry RtlUnwindEx HeapFree HeapAlloc RtlPcToFileHeader TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetSystemTimeAsFileTime FlsSetValue GetCommandLineA HeapReAlloc HeapQueryInformation HeapSize VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery EncodePointer DecodePointer FlsGetValue FlsFree FlsAlloc HeapSetInformation HeapCreate HeapDestroy GetStdHandle GetModuleFileNameA GetACP GetOEMCP IsValidCodePage GetDateFormatA GetTimeFormatA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetTimeZoneInformation LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime lstrlenA CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale DeleteCriticalSection LocalReAlloc TlsSetValue GlobalHandle GlobalReAlloc TlsAlloc InitializeCriticalSection EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GlobalFlags GetProfileIntW FileTimeToSystemTime CopyFileW GlobalSize FormatMessageW LocalFree MulDiv GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetTickCount GetPrivateProfileStringW lstrlenW WritePrivateProfileStringW FreeResource GetCurrentProcessId GlobalAddAtomW CloseHandle GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA lstrcmpW WideCharToMultiByte Sleep GlobalAlloc GlobalLock GlobalUnlock GlobalFree lstrcpynW FreeLibrary GetVersionExW MultiByteToWideChar RaiseException DebugBreak LoadResource LockResource SizeofResource FindResourceW GetModuleHandleW LoadLibraryW GetProcAddress GetLastError SetLastError GetCommandLineW lstrcatW GetModuleFileNameW CreateProcessW GetCPInfo ExitProcess

user32

InvalidateRgn GetNextDlgGroupItem MessageBeep IsRectEmpty WindowFromPoint DestroyMenu EndPaint BeginPaint GetWindowDC ClientToScreen GrayStringW DrawTextExW TabbedTextOutW ShowWindow MoveWindow SetWindowTextW IsDialogMessageW RegisterWindowMessageW SendDlgItemMessageA SendDlgItemMessageW WinHelpW IsChild GetCapture GetClassNameW GetClassLongPtrW SetPropW GetPropW RemovePropW SetFocus GetWindowTextLengthW GetWindowTextW GetTopWindow GetWindowLongPtrW SetWindowLongPtrW CopyAcceleratorTableW GetMessageTime MapWindowPoints TrackPopupMenu SetMenu GetScrollRange GetScrollPos SetForegroundWindow GetSubMenu GetMenuItemID CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW IntersectRect SystemParametersInfoA GetWindowPlacement SetWindowContextHelpId MapDialogRect SetWindowPos RegisterClipboardFormatW SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog GetWindowThreadProcessId GetWindowLongW GetSystemMetrics DrawIcon AppendMenuW SendMessageW GetLastActivePopup IsWindowEnabled MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible PeekMessageW GetCursorPos ValidateRect CharNextW PostThreadMessageW CharUpperW GetSysColorBrush SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadCursorW ReleaseCapture SetCapture UnhookWindowsHookEx SetRect GetSystemMenu IsIconic GetClientRect EnableWindow LoadIconW GetFocus PostMessageW GetDC ReleaseDC UpdateWindow InvalidateRect GetWindow GetParent PtInRect InflateRect OffsetRect FillRect GetWindowRect GetSysColor GetDesktopWindow GetKeyState GetMessagePos SetClipboardData CloseClipboard EmptyClipboard DrawTextW CreatePopupMenu GetMenuItemCount ScreenToClient OpenClipboard CopyRect EqualRect DrawFocusRect PostQuitMessage CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW LoadBitmapW GetForegroundWindow

gdi32

ExtSelectClipRgn DeleteDC GetStockObject GetDeviceCaps CreatePen CreateSolidBrush CopyMetaFileW GetMapMode GetBkColor GetTextColor GetRgnBox ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetTextExtentPoint32W GetWindowExtEx GetViewportExtEx MoveToEx LineTo SetMapMode RestoreDC SaveDC SetBkColor SetTextColor GetClipBox CreateRectRgnIndirect CreateBitmap DeleteObject CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap GetCurrentObject GetObjectW PtVisible

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegCreateKeyExW RegDeleteValueW RegSetValueExW RegCloseKey RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW

shell32

ShellExecuteW

comctl32

ord17

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

oledlg

OleUIBusyW

ole32

CreateStreamOnHGlobal CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoRegisterMessageFilter CoRevokeClassObject CoGetClassObject RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleFlushClipboard OleIsCurrentClipboard OleDuplicateData CoTaskMemAlloc ReleaseStgMedium CoTaskMemFree CLSIDFromString CLSIDFromProgID OleInitialize CoFreeUnusedLibraries OleUninitialize DoDragDrop

oleaut32

SystemTimeToVariantTime VarBstrFromDate SysFreeString VarUdateFromDate VarDateFromStr SysAllocStringLen VariantClear VariantChangeType VariantInit SysStringLen OleCreateFontIndirect SafeArrayDestroy SysAllocString VariantCopy VariantTimeToSystemTime

Name

.text

Size

465KB

Virtual Size

465KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

296KB

Virtual Size

295KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

eae4139921ebdc7ceaab0f5e69d1f0ddb6bafba8ba8afc6fb76831ea672f27df

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

generic