devldr_original[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
devldr_original.exe
Size 948KB
Sample260925-2vda8ay12r
SHA256 52e798a8040650a15e1fddd293a8091930cdab85550da07273198de890f56b0a
MD5 85b8270ea892901994a35719afe40e04
SHA1 53273b885d907c7a8dd962686a29bad5e59421b8
SHA512 91219267cd37e222880fee45d89b137e19ff0042156bf7ce3cba247585a113cfcdf8e848015eca7b3fe15942bc7b3d4e7cb02b4b089e75c430dfb84cc14768fa
SSDEEP 24576:CdZjSZHElaTW2tcigdXqSNLmTLeDQYEd2AcsQ:gBHj76E6vekYns
TLSH
T1C025BF01F643A0F2FA87357820BBBE3F9725A51457265ED3C3D02D57E5123F12A7A0AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
devldr_original.exe

File Explorer

devldr_original.exe

.exe 948KB

devldr_original.exe

IMPHASH 5047801ed1877e0cd5cb9c2ecec3de36
SHA256 52e798a8040650a15e1fddd293a8091930cdab85550da07273198de890f56b0a
MD5 85b8270ea892901994a35719afe40e04
SHA1 53273b885d907c7a8dd962686a29bad5e59421b8
SHA512 91219267cd37e222880fee45d89b137e19ff0042156bf7ce3cba247585a113cfcdf8e848015eca7b3fe15942bc7b3d4e7cb02b4b089e75c430dfb84cc14768fa
SSDEEP 24576:CdZjSZHElaTW2tcigdXqSNLmTLeDQYEd2AcsQ:gBHj76E6vekYns
TLSH
T1C025BF01F643A0F2FA87357820BBBE3F9725A51457265ED3C3D02D57E5123F12A7A0AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

27248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

msvcrt

memchr atoi _wcslwr __libm_sse2_sinf atof _CIfmod _stricmp strstr strrchr sscanf _wcsnicmp free malloc realloc strtoul _vsnprintf_s _strlwr ceil memmove system strchr _purecall memcpy wcsrchr memset

kernel32

GlobalFree GlobalLock GlobalUnlock GlobalAlloc LeaveCriticalSection EnterCriticalSection RtlCaptureContext GetCurrentDirectoryA CreateFileW GetVolumeInformationW CloseHandle GetLastError CreateFileMappingW MapViewOfFile UnmapViewOfFile MoveFileW GetCommandLineA ExitProcess GetProcAddress GetModuleFileNameA GetFileSize ReadFile Sleep CreateDirectoryW DeleteFileW GetProcessTimes OpenProcess HeapAlloc HeapFree GetProcessHeap Wow64EnableWow64FsRedirection ContinueDebugEvent DebugActiveProcess DebugActiveProcessStop WaitForDebugEventEx CreateThread OpenThread GetThreadContext GetSystemTimePreciseAsFileTime ReadProcessMemory DebugSetProcessKillOnExit FindClose FindFirstFileA FindNextFileA GetModuleHandleW GetCurrentProcessId QueryPerformanceCounter QueryPerformanceFrequency FindFirstFileW FindNextFileW GetFileTime GetCurrentDirectoryW WriteFile

user32

UpdateWindow AdjustWindowRectEx GetWindowLongA SetWindowLongA LoadCursorW DefWindowProcW GetClientRect MessageBoxA ScreenToClient PtInRect CallWindowProcW GetForegroundWindow GetCursorPos GetWindowLongW SetWindowLongW SetCapture ShowWindow DestroyWindow GetDesktopWindow GetWindowRect PeekMessageW DispatchMessageW TranslateMessage SetProcessDPIAware CreateWindowExW GetWindowThreadProcessId SendMessageTimeoutW OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable IsIconic GetRawInputData RegisterClassExW GetClassNameW EnumWindows GetWindowTextW SetWindowPos

gdi32

AddFontMemResourceEx CreateCompatibleDC CreateFontA DeleteDC DeleteObject GetGlyphOutlineW GetTextExtentPoint32W RemoveFontMemResourceEx GetFontUnicodeRanges SelectObject SetBkColor SetMapMode SetTextColor SetTextAlign CreateDIBSection ExtTextOutW

shell32

ShellExecuteW

ntdll

NtQueryVirtualMemory NtAllocateVirtualMemory NtQueryInformationThread RtlAdjustPrivilege NtDelayExecution NtFreeVirtualMemory NtQueryInformationProcess NtClose NtQuerySystemInformation RtlFreeHeap RtlAllocateHeap NtCreateFile NtOpenProcess NtTerminateProcess

psapi

GetModuleFileNameExA

capstone

cs_malloc cs_open cs_close cs_option cs_free cs_disasm_iter

d3d9

Direct3DCreate9Ex

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

Name

.text

Size

466KB

Virtual Size

465KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.init

Size

1024B

Virtual Size

522B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

288KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

devldr_original.exe

msvcrt

kernel32

user32

gdi32

shell32

ntdll

psapi

capstone

d3d9

dwmapi

generic