4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda

Sharing

Copy URL Twitter E-mail

General

Target
4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda
Size 11.1MB
Sample260925-msrnhazwex
SHA256 4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda
MD5 59172025ea84c95c07c1f8c0571b06cf
SHA1 67379580a5dd88e2aa969011041c8595a0b8d944
SHA512 cf0dc60ca702c857d97bcff1b3f178d423a9e5e50d301267530cab7c1da82f4d588466e6b2a72b5fd5117bd28071ac1062f630f7170a22e44ec9622a67d68a8e
SSDEEP 196608:TQXjyF4MNkE10JUYx6/k5pSmvZBntKORk2CssYAl:TQXjW4Y0UYxl5pSoFQ2C
TLSH
T171C6A011FA428131F992007199AEBBBF896C57780B3511C763E42D27BEF00D26B75B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda

File Explorer

4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda

.exe 11.1MB

4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda

IMPHASH e34105e150af0b88e218e3f6f50c3473
SHA256 4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda
MD5 59172025ea84c95c07c1f8c0571b06cf
SHA1 67379580a5dd88e2aa969011041c8595a0b8d944
SHA512 cf0dc60ca702c857d97bcff1b3f178d423a9e5e50d301267530cab7c1da82f4d588466e6b2a72b5fd5117bd28071ac1062f630f7170a22e44ec9622a67d68a8e
SSDEEP 196608:TQXjyF4MNkE10JUYx6/k5pSmvZBntKORk2CssYAl:TQXjW4Y0UYxl5pSoFQ2C
TLSH
T171C6A011FA428131F992007199AEBBBF896C57780B3511C763E42D27BEF00D26B75B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9091963

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\china\2500\Client\China_2022_Release\Client.pdb

d3d9

Direct3DCreate9

winmm

timeGetTime

dinput8

DirectInput8Create

imm32

ImmSetOpenStatus ImmReleaseContext ImmSetCompositionFontA ImmNotifyIME ImmSetCompositionWindow ImmGetCompositionStringA ImmGetCompositionWindow ImmIsIME ImmSetCandidateWindow ImmGetCandidateWindow ImmGetCandidateListA ImmGetOpenStatus ImmGetDefaultIMEWnd ImmGetConversionStatus ImmSetConversionStatus ImmSetCompositionStringW ImmGetProperty ImmGetContext

ws2_32

WSAGetLastError WSARecv connect bind socket WSAEventSelect WSASetLastError gethostbyname htons inet_addr closesocket WSAAsyncGetHostByAddr WSACloseEvent inet_ntoa WSACreateEvent WSASend WSAEnumNetworkEvents WSACleanup gethostname WSAStartup recv WSAAsyncGetHostByName ntohs WSAAsyncSelect getsockname gethostbyaddr getsockopt recvfrom sendto shutdown select accept listen htonl setsockopt send ioctlsocket

ijl11

ord3 ord5 ord2

dsetup

ord11

ddraw

DirectDrawCreateEx

wininet

HttpOpenRequestA HttpSendRequestExA HttpEndRequestA InternetOpenA InternetSetStatusCallback InternetConnectA HttpSendRequestA HttpQueryInfoA InternetReadFile InternetReadFileExA InternetCrackUrlA FtpPutFileA InternetCloseHandle

kilos

?OAL_sample_status@@YGHPAU__SAMPLE_OAL@@@Z ?OAL_start_stream@@YGXPAU__STREAM_OAL@@@Z ?OAL_set_stream_loop_count@@YGXPAU__STREAM_OAL@@H@Z ?OAL_open_stream@@YGPAU__STREAM_OAL@@PAU_OPENAL_DIG_DRIVER@@PBDH@Z ?OAL_allocate_sample_handle@@YGPAU__SAMPLE_OAL@@PAU_OPENAL_DIG_DRIVER@@@Z ?OAL_file_read@@YGPAXPBDPAX@Z ?OAL_set_sample_file@@YGHPAU__SAMPLE_OAL@@PBXH@Z ?OAL_set_sample_volume_levels@@YGXPAU__SAMPLE_OAL@@MM@Z ?OAL_start_sample@@YGXPAU__SAMPLE_OAL@@@Z ?OAL_mem_free_lock@@YGXPAX@Z ?OAL_release_sample_handle@@YGXPAU__SAMPLE_OAL@@@Z ?OAL_startup@@YGXH@Z ?OAL_open_digital_driver@@YGPAU_OPENAL_DIG_DRIVER@@KHHI@Z ?OAL_shutdown@@YGXXZ ?OAL_close_digital_driver@@YGXPAU_OPENAL_DIG_DRIVER@@@Z ?OAL_close_stream@@YGXPAU__STREAM_OAL@@@Z ?OAL_stream_status@@YGHPAU__STREAM_OAL@@@Z

libcrypto-3

RSA_public_encrypt RSA_free d2i_RSAPublicKey RSA_size AES_set_encrypt_key AES_cbc_encrypt AES_set_decrypt_key

kernel32

GetFileType InitializeCriticalSectionAndSpinCount VirtualQuery RtlUnwind RaiseException GetStartupInfoW IsDebuggerPresent FreeLibraryAndExitThread GetThreadTimes GetCurrentThread OutputDebugStringW QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList LoadLibraryW LoadLibraryExW TryEnterCriticalSection ExitProcess SetLastError GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx EncodePointer UnhandledExceptionFilter VerifyVersionInfoW SetProcessAffinityMask GetProcessAffinityMask InitializeSListHead ReleaseSemaphore DuplicateHandle UnregisterWait GetTickCount64 lstrlenA CreateFileA ReadFile SetFilePointer CloseHandle WriteFile GetFileSize GetLocalTime Sleep QueryPerformanceFrequency QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte lstrcpyA GetFileAttributesA GetModuleFileNameA lstrcatA LoadLibraryA GetProcAddress FreeLibrary DeviceIoControl GetCurrentProcess LocalFree GetLastError IsDBCSLeadByteEx WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA CreateDirectoryA FindFirstFileA FindClose SetUnhandledExceptionFilter GetCurrentThreadId GetCurrentProcessId TerminateProcess DeleteFileA CopyFileA FindNextFileA CreateToolhelp32Snapshot Process32First Process32Next VerSetConditionMask VerifyVersionInfoA GetCurrentDirectoryA RemoveDirectoryA LCMapStringW GetTickCount InitializeCriticalSection CreateThread SetThreadPriority GlobalMemoryStatus EnterCriticalSection GetExitCodeThread TerminateThread LeaveCriticalSection OutputDebugStringA GetSystemInfo MapViewOfFile UnmapViewOfFile DeleteCriticalSection SetCurrentDirectoryA CreateFileMappingA GetModuleHandleA _lread _lopen _lclose _llseek CreateFileW GetDriveTypeW GetVolumeInformationW FindFirstFileW ReadConsoleW FormatMessageA IsBadReadPtr IsBadWritePtr IsDBCSLeadByte GlobalMemoryStatusEx GetTimeZoneInformation SystemTimeToFileTime WaitForSingleObject InitializeCriticalSectionEx DecodePointer IsWow64Process GlobalLock GlobalUnlock GlobalAlloc GlobalFree InterlockedIncrement InterlockedDecrement GetEnvironmentVariableA GetTempFileNameA GetTempPathA IsProcessorFeaturePresent GetProfileIntA DebugBreak FatalAppExitA LockResource LoadResource SizeofResource FindResourceA FindResourceW VirtualFree VirtualAlloc InterlockedExchange InterlockedCompareExchange GetFullPathNameA lstrcmpiA HeapAlloc GetProcessHeap HeapFree TlsSetValue GetLocaleInfoEx CreateSymbolicLinkW GetFileInformationByHandleEx GetModuleHandleW CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer FreeLibraryWhenCallbackReturns GetSystemTimeAsFileTime GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce GetTempPathW SetFileInformationByHandle SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetNativeSystemInfo SwitchToThread WaitForSingleObjectEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive TlsFree GetCurrentProcessorNumberEx GetLogicalProcessorInformation GetLogicalProcessorInformationEx CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetThreadGroupAffinity SetThreadGroupAffinity GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP SetStdHandle SetEndOfFile GetFileSizeEx DeleteFileW MoveFileExW GetFileAttributesExW SetConsoleCtrlHandler GetModuleHandleExW GetExitCodeProcess CreatePipe FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetModuleFileNameW SetEvent SignalObjectAndWait GetConsoleMode ExitThread ResumeThread CreateProcessW GetStdHandle CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect SetFilePointerEx HeapReAlloc HeapSize HeapQueryInformation FlsAlloc FlsGetValue FlsSetValue FlsFree FindNextFileW IsThreadAFiber GetThreadPriority TlsAlloc TlsGetValue GetVersionExA RegisterWaitForSingleObject RtlCaptureStackBackTrace

user32

ChangeDisplaySettingsA DispatchMessageA TranslateMessage GetMessageA PeekMessageA ClipCursor SetWindowPos GetKeyState AdjustWindowRectEx SetForegroundWindow PostQuitMessage DestroyMenu GetMenu AdjustWindowRect LoadIconA IntersectRect OffsetRect CharLowerA MoveWindow SetActiveWindow GetWindowRect GetWindowPlacement IsIconic GetSystemMetrics EnumWindows ShowCursor keybd_event LoadStringA GetClassInfoA CopyRect SetRectEmpty GetPropA SetPropA RemovePropA GetKeyboardState SetFocus SystemParametersInfoA GetWindowTextA GetClassNameA EndDialog PtInRect SetCursor DrawTextA wsprintfA ShowWindow SetWindowLongA CreateWindowExA ClientToScreen GetCaretPos DestroyWindow GetKeyboardLayout SendMessageA RegisterClassA LoadCursorA DefWindowProcA GetWindowLongA PostMessageA GetAsyncKeyState SetCursorPos GetIconInfo ScreenToClient GetClientRect GetCursorPos GetActiveWindow SetRect ReleaseDC GetDC MessageBoxA UnregisterClassA BeginPaint EndPaint InvalidateRect GetWindowRgn GetCursor DrawIcon EnumDisplaySettingsA UnionRect FillRect OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetForegroundWindow TrackMouseEvent GetCapture GetLastActivePopup MessageBoxW SetCapture ReleaseCapture IsWindowUnicode SetProcessDPIAware MonitorFromWindow

gdi32

RemoveFontResourceA Rectangle BitBlt CreateDIBitmap CreateDIBSection CreateRectRgn OffsetRgn SelectClipRgn CreateSolidBrush GetDCOrgEx GetDeviceCaps GetObjectW GetCharacterPlacementA GetCharacterPlacementW GetTextMetricsA GetTextMetricsW GetFontLanguageInfo CreateFontIndirectA CreateFontIndirectW MoveToEx ExtTextOutW GetClipBox CreateFontA TextOutA GetTextColor GetStockObject GetDIBits CreateCompatibleDC GetObjectA ExtTextOutA SetTextAlign SetBkColor SetTextColor SetBkMode DeleteObject SelectObject DeleteDC SetMapMode GetTextExtentPoint32A

comdlg32

GetSaveFileNameA GetOpenFileNameA

advapi32

ConvertSidToStringSidA GetTokenInformation RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegCloseKey RegOpenKeyA RegSetValueExA OpenProcessToken

shell32

SHBrowseForFolderA SHGetPathFromIDListA

ole32

CoTaskMemFree CoUninitialize CoCreateInstance CoInitialize CLSIDFromString

oleaut32

SetErrorInfo CreateErrorInfo VariantChangeType GetErrorInfo SysAllocStringLen SysFreeString SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate SysAllocString VariantClear VariantInit

dwmapi

DwmGetColorizationColor DwmIsCompositionEnabled DwmEnableBlurBehindWindow

epc

ord1

Name

.Milkkkk

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.Milkkkk

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Milkkkk

Size

165KB

Virtual Size

62.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Milkkkk

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Milkkkk

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.Milkkkk

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

4dba6b68a8f32bc26fff3f6971c2f60f5236828a886590b1dc994fdc75d01eda

d3d9

winmm

dinput8

imm32

ws2_32

ijl11

dsetup

ddraw

wininet

kilos

libcrypto-3

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

dwmapi

epc

generic