a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a

Sharing

Copy URL Twitter E-mail

General

Target
a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a
Size 1.0MB
Sample260924-prs62stfjf
SHA256 a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a
MD5 4198ce4b0ddda6a08de6128bdd1c2527
SHA1 a19d89e01645721c9ddd870ec617bb3476486f1f
SHA512 e7039ce872b151ef1be30a7f6f452e86ab91f83983ad21973ec64130e28e74b72ed388c8c53d1b14bdc09edf5a8f306baf7f8234bd14bc62c17d14bb6e857dd3
SSDEEP 12288:jnGpg9QYQPtU+xvF+8g9PFYQPtU+xvF+3I:ziSQVbxvF38OQVbxvF2I
TLSH
T1EA35826127E9C105F0F3AB34587287913E32BD529B34DAFFA680A6DD0733994DA35722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a

File Explorer

a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a

.exe 1.0MB

a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a

IMPHASH 5af714ba0938638631e87227c44706f8
SHA256 a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a
MD5 4198ce4b0ddda6a08de6128bdd1c2527
SHA1 a19d89e01645721c9ddd870ec617bb3476486f1f
SHA512 e7039ce872b151ef1be30a7f6f452e86ab91f83983ad21973ec64130e28e74b72ed388c8c53d1b14bdc09edf5a8f306baf7f8234bd14bc62c17d14bb6e857dd3
SSDEEP 12288:jnGpg9QYQPtU+xvF+8g9PFYQPtU+xvF+3I:ziSQVbxvF38OQVbxvF2I
TLSH
T1EA35826127E9C105F0F3AB34587287913E32BD529B34DAFFA680A6DD0733994DA35722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

57968

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comdlg32

ChooseColorW ChooseFontW GetOpenFileNameW

comctl32

ord320 ord388 ord323 ord324 InitCommonControls PropertySheetW

shell32

ord155 SHBindToParent SHBrowseForFolderW SHCreateDirectoryExW SHFileOperationW ord195 SHGetDesktopFolder SHGetFolderLocation SHGetFolderPathW ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize PropVariantClear

winmm

PlaySoundW midiOutGetDevCapsW midiOutGetNumDevs

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveExtensionW StrDupW StrRetToBufW StrRetToStrW

uxtheme

ord4 CloseThemeData ord3 DrawThemeBackground DrawThemeParentBackground ord9 ord10 ord8 GetCurrentThemeName GetThemeMargins IsThemeActive IsThemeBackgroundPartiallyTransparent OpenThemeDataForDpi ord2

user32

AdjustWindowRectEx CheckDlgButton CheckRadioButton DestroyIcon DialogBoxParamW DrawEdge DrawFocusRect DrawFrameControl DrawIconEx EnableWindow EndDialog EnumWindows FillRect FrameRect GetClientRect GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemInt GetDpiForWindow GetMenu GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindowLongW GetWindowTextLengthW GetWindowTextW InvalidateRect IsDlgButtonChecked KillTimer LoadCursorW LoadIconW LoadImageW LoadStringW MessageBoxIndirectW MessageBoxW MoveWindow ReleaseDC SendDlgItemMessageW SendMessageW SetCursor SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetFocus SetSysColors SetTimer SetWindowLongW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow SystemParametersInfoW

gdi32

CreateFontIndirectW CreateFontW CreateSolidBrush DeleteObject GetDeviceCaps GetObjectW SetBkColor SetTextColor

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegSetValueExW

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _assert _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _strdup _wcsdup _wcsicmp bsearch exit free fwrite getenv malloc memcpy memmove realloc setlocale strchr strcmp strcpy strcspn strlen strrchr toupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstol wcstoul

kernel32

CloseHandle CreateFileW CreateProcessW DeviceIoControl ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageA GetCommandLineW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetStartupInfoW GetTickCount GetVolumeInformationW GlobalGetAtomNameW HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsWow64Process MulDiv MultiByteToWideChar SetVolumeLabelW WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile lstrcmpiW

ntdll

RtlDosPathNameToNtPathName_U RtlFreeUnicodeString _vsnprintf

Name

.text

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

648KB

Virtual Size

647KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/43

Size

160KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

40KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

40KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

128KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a844b4dea67e0b81fd4c834303a5ee05b5e22acfef99cca71a9ef9bd8ce21e5a

comdlg32

comctl32

shell32

ole32

winmm

shlwapi

uxtheme

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic