d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e

Sharing

Copy URL Twitter E-mail

General

Target
d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e
Size 2.7MB
Sample260924-c2fx9ayale
SHA256 d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e
MD5 8525232986ed8f75a8bd40ff3c085186
SHA1 6f52f09ff657e5aaff539408a82fe5dcb26bd810
SHA512 748d2f963c9a132fa308a741ff58346f99fa9dfcbd583a9d0d294cd4a38a4360314db0fb6f031c4d2570d893eb7e9d45fc1250b0f2d64aa528ca3c701769aec8
SSDEEP 49152:yzJDyfYwQMShAZUIFk7kkn24GH1XR83/38m6yCvK8xCK4RxQWpFIloGRJShb+6TV:yzJDyAwULI6wknM1XRsVhVtbl
TLSH
T119D5BE05B79280F2C4860270705AB77F9B395DB04F2F56C3E3D069786A653E26A77E23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e

File Explorer

d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e

.exe 2.7MB

d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e

IMPHASH 4d59571afc7f089b0b9ef5813c9fb1dd
SHA256 d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e
MD5 8525232986ed8f75a8bd40ff3c085186
SHA1 6f52f09ff657e5aaff539408a82fe5dcb26bd810
SHA512 748d2f963c9a132fa308a741ff58346f99fa9dfcbd583a9d0d294cd4a38a4360314db0fb6f031c4d2570d893eb7e9d45fc1250b0f2d64aa528ca3c701769aec8
SSDEEP 49152:yzJDyfYwQMShAZUIFk7kkn24GH1XR83/38m6yCvK8xCK4RxQWpFIloGRJShb+6TV:yzJDyAwULI6wknM1XRsVhVtbl
TLSH
T119D5BE05B79280F2C4860270705AB77F9B395DB04F2F56C3E3D069786A653E26A77E23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1680272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\thprac\thprac\Release\thprac.pdb

kernel32

WriteFile ExitProcess VirtualProtect GetModuleHandleW QueryPerformanceCounter AddVectoredExceptionHandler VirtualAlloc QueryPerformanceFrequency ExitThread DeleteFileW GetFileAttributesW GetTempPathW GetLastError WaitForSingleObject Sleep CreateThread TerminateThread GetExitCodeThread GetProcAddress CopyFileW MoveFileW GetEnvironmentVariableW FindClose FindFirstFileW FindNextFileW GetFullPathNameW CreateRemoteThread ResumeThread CreateProcessW OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx lstrcmpW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetCurrentThreadId GetCurrentDirectoryW CreateMutexW VirtualProtectEx GetModuleHandleA LoadLibraryA GetUserDefaultUILanguage OpenMutexA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle GetCurrentProcessId HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetEndOfFile HeapReAlloc GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetModuleHandleExW GetCommandLineW GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind InitializeSListHead WriteConsoleW GetSystemTimeAsFileTime GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter ReadFile CreateDirectoryW AttachConsole LocalFree LoadLibraryW GetModuleFileNameW UnmapViewOfFile MapViewOfFile CreateFileMappingW GetCPInfo GetStringTypeW DecodePointer EncodePointer GetCurrentProcess OpenMutexW CloseHandle InitializeCriticalSectionEx LoadLibraryExA FreeLibrary VirtualQuery GetSystemInfo RaiseException SetFilePointer GetFileSize CreateFileW SetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock FindFirstFileExW GlobalAlloc

ntdll

NtQueryInformationProcess

user32

EmptyClipboard SetWindowPos GetClipboardData OpenClipboard SetClipboardData CloseClipboard GetDlgItem GetSystemMetrics MonitorFromWindow EnumDisplaySettingsW LoadIconW FindWindowW AdjustWindowRectEx UpdateWindow GetKeyState IsIconic RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW GetWindowThreadProcessId SetForegroundWindow SetActiveWindow SetFocus AttachThreadInput IsDialogMessageW SetWindowTextW CreateWindowExW CreateDialogParamW ShowWindow DestroyWindow SendMessageW PeekMessageW DispatchMessageW TranslateMessage GetAsyncKeyState LoadCursorW GetDesktopWindow ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetWindowRect GetForegroundWindow ReleaseCapture SetCapture GetCapture GetKeyNameTextA IsChild CallWindowProcW DefWindowProcA MessageBoxA SetWindowLongW GetWindowLongW MessageBoxW GetClientRect

gdi32

CreateCompatibleDC DeleteDC CreateFontW DeleteObject SelectObject GetStockObject GetFontData EnumFontFamiliesExW

shlwapi

PathRemoveFileSpecW PathRelativePathToW PathIsRelativeW

ole32

CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance

comdlg32

GetSaveFileNameW GetOpenFileNameW

shell32

CommandLineToArgvW SHFileOperationW SHParseDisplayName SHBrowseForFolderW SHGetPathFromIDListW SHGetFolderPathW ShellExecuteW

advapi32

OpenProcessToken RegCloseKey RegQueryValueExW RegOpenKeyW GetTokenInformation

winmm

joyGetDevCapsW

imm32

ImmSetCompositionWindow ImmGetContext ImmAssociateContext ImmReleaseContext

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

656KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d97c551753c87e98dc5d851905751b9053ebc1c8a1fe725dd8b7a4248d83a61e

kernel32

ntdll

user32

gdi32

shlwapi

ole32

comdlg32

shell32

advapi32

winmm

imm32

generic