d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1

Sharing

Copy URL Twitter E-mail

General

Target
d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1
Size 612KB
Sample260925-ks4a7ace75
SHA256 d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1
MD5 cc15c9f309bb1240b585d69627eacd30
SHA1 42947d97d0fd86e9373d047f66d46f6f6fd9aafd
SHA512 30b7736a3072d1906179d4c0e00e53e14d6fe76e17e8398e7f4738fdc7775abe019c66b11c29935e148a84a2547ee09d546a47fb50ba883d0a9353bce3ed898f
SSDEEP 6144:yKkvxiQSxHwg/+GXAz2kp71vcFPR5zw9x3ii1y1W8Op:yKkvxiQSxQi+GXk2TS9VYA8Op
TLSH
T140D4951077F49556F6F38B386DB6D2512A3A7E416B36CB0FD204192C0936BD2DEA0B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1

File Explorer

d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1

.dll 612KB

d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1

IMPHASH a9427ef4007afa8d25ed6cfa508eabf0
SHA256 d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1
MD5 cc15c9f309bb1240b585d69627eacd30
SHA1 42947d97d0fd86e9373d047f66d46f6f6fd9aafd
SHA512 30b7736a3072d1906179d4c0e00e53e14d6fe76e17e8398e7f4738fdc7775abe019c66b11c29935e148a84a2547ee09d546a47fb50ba883d0a9353bce3ed898f
SSDEEP 6144:yKkvxiQSxHwg/+GXAz2kp71vcFPR5zw9x3ii1y1W8Op:yKkvxiQSxQi+GXk2TS9VYA8Op
TLSH
T140D4951077F49556F6F38B386DB6D2512A3A7E416B36CB0FD204192C0936BD2DEA0B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4896

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegDeleteKeyW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryValueExW

bcrypt

BCryptHash

comctl32

ImageList_Create ImageList_Destroy ImageList_ReplaceIcon InitCommonControlsEx PropertySheetW

comdlg32

GetOpenFileNameW

kernel32

DelayLoadFailureHook GetTickCount HeapReAlloc IsBadStringPtrW ResolveDelayLoadedAPI

kernelbase

CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteFileW GetFileSize GetFinalPathNameByHandleW GetModuleHandleW GetProcAddress GetSystemDirectoryW HeapAlloc HeapFree LocalFree MapViewOfFile MultiByteToWideChar PathAllocCanonicalize UnmapViewOfFile

ntdll

_vsnprintf

ole32

CoTaskMemAlloc

shell32

ExtractIconExW ShellExecuteExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wgetenv calloc free fwrite getenv malloc memcpy memmove realloc strchr strcmp strcspn strlen wcschr wcscmp wcslen wcsncmp wcstol

urlmon

CreateAsyncBindCtx CreateURLMoniker

user32

DestroyIcon DialogBoxParamW DispatchMessageW EnableWindow EndDialog GetDlgItem GetSystemMetrics GetWindowTextW LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PeekMessageW SendDlgItemMessageW SendMessageW SetWindowTextW ShowWindow TranslateMessage wsprintfW

Name

.text

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

264KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d0d925582e8f84f1fbc52032d0cc025d9ef2fa01bca669c23161c5bd77d76bf1

advapi32

bcrypt

comctl32

comdlg32

kernel32

kernelbase

ntdll

ole32

shell32

ucrtbase

urlmon

user32

generic