f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7

Sharing

Copy URL Twitter E-mail

General

Target
f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7
Size 763KB
Sample260925-kxd7vsty7q
SHA256 f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7
MD5 a00a3637016727d75ebc0e1d8e34fddc
SHA1 64bf700d744be02aa16e5294aa255d8fee5b8604
SHA512 427f9e1c503dc9ffd60e5887e3b021128f8594e5a8570ed38cff127d4a99e69e511e7d4c7daf268bf3f8c3194933b694c4ab3609a34ed168cb7cb141a194ff8d
SSDEEP 12288:wfVlKFv3/WHu31XyHhgbnkHIeq8Wvgky+RlGKU3uR:wfVl+//WHuFXOhqH
TLSH
T144F42891F39A6492E9B75B3849EFD37E2728BB604535CF5BEB04DA483D23AE09C50341
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7

File Explorer

f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7

.dll 763KB

f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7

IMPHASH 9a317b4c9e8750edcd45bdf4798ec0bd
SHA256 f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7
MD5 a00a3637016727d75ebc0e1d8e34fddc
SHA1 64bf700d744be02aa16e5294aa255d8fee5b8604
SHA512 427f9e1c503dc9ffd60e5887e3b021128f8594e5a8570ed38cff127d4a99e69e511e7d4c7daf268bf3f8c3194933b694c4ab3609a34ed168cb7cb141a194ff8d
SSDEEP 12288:wfVlKFv3/WHu31XyHhgbnkHIeq8Wvgky+RlGKU3uR:wfVl+//WHuFXOhqH
TLSH
T144F42891F39A6492E9B75B3849EFD37E2728BB604535CF5BEB04DA483D23AE09C50341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyW RegQueryValueExW RegSetValueExW

kernel32

CloseHandle CompareFileTime CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreateSemaphoreW CreateThread DelayLoadFailureHook DeleteCriticalSection DeleteFileW DosDateTimeToFileTime EnterCriticalSection FileTimeToDosDateTime FileTimeToSystemTime FreeLibrary FreeLibraryAndExitThread GetComputerNameExA GetDateFormatA GetDiskFreeSpaceExA GetFileAttributesExW GetFileInformationByHandle GetFileSize GetLocalTime GetModuleHandleExW GetModuleHandleW GetProcAddress GetShortPathNameW GetSystemTime GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetTimeFormatA GlobalAlloc HeapAlloc HeapReAlloc IdnToAscii IdnToUnicode InitOnceExecuteOnce InitializeCriticalSectionEx IsBadReadPtr IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenFileMappingW QueryPerformanceCounter QueryPerformanceFrequency QueueUserWorkItem RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResolveDelayLoadedAPI RtlUnwind SetEndOfFile SetEvent SetFilePointer SetFilePointerEx SetThreadDescription Sleep SystemTimeToFileTime TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile WaitForSingleObject WideCharToMultiByte WriteFile

mpr

WNetCachePassword WNetGetCachedPassword

ntdll

NtQuerySystemTime _vsnprintf

shell32

SHFileOperationW SHGetSpecialFolderPathW

shlwapi

PathCreateFromUrlW PathMatchSpecW StrStrIA StrToInt64ExW UrlCanonicalizeA UrlCanonicalizeW UrlCombineA UrlCombineW UrlEscapeW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _assert _errno _ltow _strdup _stricmp _time32 _wcsdup _wcsicmp _wcsnicmp _wgetenv atoi atol calloc free fwrite getenv iswalnum iswalpha iswspace malloc memchr memcmp memcpy memmove memset qsort rand realloc strchr strcmp strcpy strcspn strlen strncmp strnlen strtok system towlower wcschr wcscmp wcscspn wcslen wcsncmp wcsnlen wcsrchr wcsspn wcsstr wcstol wcstoul

user32

CharLowerW DialogBoxParamW EndDialog GetDlgItem GetWindowLongW GetWindowTextW LoadStringA LoadStringW SendMessageW SetWindowLongW SetWindowTextW wsprintfW

ws2_32

accept bind closesocket connect getsockname getsockopt htons ioctlsocket listen recv select send setsockopt socket WSAGetLastError WSAStartup WSACleanup FreeAddrInfoW GetAddrInfoW freeaddrinfo getaddrinfo getnameinfo inet_ntop

CommitUrlCacheEntryA CommitUrlCacheEntryW CreateMD5SSOHash CreateUrlCacheContainerA CreateUrlCacheContainerW CreateUrlCacheEntryA CreateUrlCacheEntryW CreateUrlCacheGroup DeleteIE3Cache DeleteUrlCacheContainerA DeleteUrlCacheContainerW DeleteUrlCacheEntry DeleteUrlCacheEntryA DeleteUrlCacheEntryW DeleteUrlCacheGroup DeleteWpadCacheForNetworks DetectAutoProxyUrl DllInstall FindCloseUrlCache FindFirstUrlCacheContainerA FindFirstUrlCacheContainerW FindFirstUrlCacheEntryA FindFirstUrlCacheEntryExA FindFirstUrlCacheEntryExW FindFirstUrlCacheEntryW FindFirstUrlCacheGroup FindNextUrlCacheContainerA FindNextUrlCacheContainerW FindNextUrlCacheEntryA FindNextUrlCacheEntryExA FindNextUrlCacheEntryExW FindNextUrlCacheEntryW FindNextUrlCacheGroup ForceNexusLookup ForceNexusLookupExW FreeUrlCacheSpaceA FreeUrlCacheSpaceW FtpCommandA FtpCommandW FtpCreateDirectoryA FtpCreateDirectoryW FtpDeleteFileA FtpDeleteFileW FtpFindFirstFileA FtpFindFirstFileW FtpGetCurrentDirectoryA FtpGetCurrentDirectoryW FtpGetFileA FtpGetFileEx FtpGetFileSize FtpGetFileW FtpOpenFileA FtpOpenFileW FtpPutFileA FtpPutFileEx FtpPutFileW FtpRemoveDirectoryA FtpRemoveDirectoryW FtpRenameFileA FtpRenameFileW FtpSetCurrentDirectoryA FtpSetCurrentDirectoryW GetUrlCacheConfigInfoA GetUrlCacheConfigInfoW GetUrlCacheEntryInfoA GetUrlCacheEntryInfoExA GetUrlCacheEntryInfoExW GetUrlCacheEntryInfoW GetUrlCacheGroupAttributeA GetUrlCacheGroupAttributeW GetUrlCacheHeaderData GopherCreateLocatorA GopherCreateLocatorW GopherFindFirstFileA GopherFindFirstFileW GopherGetAttributeA GopherGetAttributeW GopherGetLocatorTypeA GopherGetLocatorTypeW GopherOpenFileA GopherOpenFileW HttpAddRequestHeadersA HttpAddRequestHeadersW HttpCheckDavCompliance HttpEndRequestA HttpEndRequestW HttpOpenRequestA HttpOpenRequestW HttpQueryInfoA HttpQueryInfoW HttpSendRequestA HttpSendRequestExA HttpSendRequestExW HttpSendRequestW IncrementUrlCacheHeaderData InternetAlgIdToStringA InternetAlgIdToStringW InternetAttemptConnect InternetAutodial InternetAutodialCallback InternetAutodialHangup InternetCanonicalizeUrlA InternetCanonicalizeUrlW InternetCheckConnectionA InternetCheckConnectionW InternetClearAllPerSiteCookieDecisions InternetCloseHandle InternetCombineUrlA InternetCombineUrlW InternetConfirmZoneCrossing InternetConfirmZoneCrossingA InternetConfirmZoneCrossingW InternetConnectA InternetConnectW InternetCrackUrlA InternetCrackUrlW InternetCreateUrlA InternetCreateUrlW InternetDebugGetLocalTime InternetDial InternetDialA InternetDialW InternetEnumPerSiteCookieDecisionA InternetEnumPerSiteCookieDecisionW InternetErrorDlg InternetFindNextFileA InternetFindNextFileW InternetFortezzaCommand InternetGetCertByURL InternetGetCertByURLA InternetGetConnectedState InternetGetConnectedStateEx InternetGetConnectedStateExA InternetGetConnectedStateExW InternetGetCookieA InternetGetCookieExA InternetGetCookieExW InternetGetCookieW InternetGetLastResponseInfoA InternetGetLastResponseInfoW InternetGetPerSiteCookieDecisionA InternetGetPerSiteCookieDecisionW InternetGetSecurityInfoByURL InternetGetSecurityInfoByURLA InternetGetSecurityInfoByURLW InternetGoOnline InternetGoOnlineA InternetGoOnlineW InternetHangUp InternetInitializeAutoProxyDll InternetLockRequestFile InternetOpenA InternetOpenServerPushParse InternetOpenUrlA InternetOpenUrlW InternetOpenW InternetQueryDataAvailable InternetQueryFortezzaStatus InternetQueryOptionA InternetQueryOptionW InternetReadFile InternetReadFileExA InternetReadFileExW InternetSecurityProtocolToStringA InternetSecurityProtocolToStringW InternetServerPushParse InternetSetCookieA InternetSetCookieExA InternetSetCookieExW InternetSetCookieW InternetSetDialState InternetSetDialStateA InternetSetDialStateW InternetSetFilePointer InternetSetOptionA InternetSetOptionExA InternetSetOptionExW InternetSetOptionW InternetSetPerSiteCookieDecisionA InternetSetPerSiteCookieDecisionW InternetSetStatusCallback InternetSetStatusCallbackA InternetSetStatusCallbackW InternetShowSecurityInfoByURL InternetShowSecurityInfoByURLA InternetShowSecurityInfoByURLW InternetTimeFromSystemTime InternetTimeFromSystemTimeA InternetTimeFromSystemTimeW InternetTimeToSystemTime InternetTimeToSystemTimeA InternetTimeToSystemTimeW InternetUnlockRequestFile InternetWriteFile InternetWriteFileExA InternetWriteFileExW IsHostInProxyBypassList IsUrlCacheEntryExpiredA IsUrlCacheEntryExpiredW LoadUrlCacheContent ParseX509EncodedCertificateForListBoxEntry PrivacyGetZonePreferenceW PrivacySetZonePreferenceW ReadUrlCacheEntryStream RegisterUrlCacheNotification ResumeSuspendedDownload RetrieveUrlCacheEntryFileA RetrieveUrlCacheEntryFileW RetrieveUrlCacheEntryStreamA RetrieveUrlCacheEntryStreamW RunOnceUrlCache SetUrlCacheConfigInfoA SetUrlCacheConfigInfoW SetUrlCacheEntryGroup SetUrlCacheEntryGroupA SetUrlCacheEntryGroupW SetUrlCacheEntryInfoA SetUrlCacheEntryInfoW SetUrlCacheGroupAttributeA SetUrlCacheGroupAttributeW SetUrlCacheHeaderData ShowCertificate ShowClientAuthCerts ShowSecurityInfo ShowX509EncodedCertificate UnlockUrlCacheEntryFile UnlockUrlCacheEntryFileA UnlockUrlCacheEntryFileW UnlockUrlCacheEntryStream UpdateUrlCacheContentPath UrlZonesDetach

Name

.text

Size

284KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

916B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

44KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

40KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

4KB

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

132KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

121B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

743B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

4KB

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f5345fe8c0c1484a2379fdb11ea7ab1cab7ad522d55dbb6148a75d2c44dab7b7

advapi32

kernel32

mpr

ntdll

shell32

shlwapi

ucrtbase

user32

ws2_32

generic