867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1

Sharing

Copy URL Twitter E-mail

General

Target
867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1
Size 6.4MB
Sample260925-nrb24avdma
SHA256 867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1
MD5 7905a4658e6c8c78b29f29bfbbc037c6
SHA1 724a8cb69dc9bd3f531aaea0286f341173a1555f
SHA512 0d5e0e6e1801953c194e020d2ac09ff636e15e285fa9b97473f62781780dd84c7652db729923e8b3ebe7381e7f90f4d0ca28a205cab3a30900c45a59efb4c57a
SSDEEP 49152:3wg9jdBjQTf79Xe//MTujnW3a/YV929DGFv49uMNCSVypctpmJXf2TBC8mmMYbTz:gBp3aXF3663uOPiWC+V9GOk
TLSH
T1AE669C03F2D641F9C09EC178C75B9237BB36B88A5625B29F1BD40B213E66FA05B0D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1

File Explorer

867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1

.dll 6.4MB

867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1

IMPHASH 1a893ff03d378ba4995b3a42c7828290
SHA256 867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1
MD5 7905a4658e6c8c78b29f29bfbbc037c6
SHA1 724a8cb69dc9bd3f531aaea0286f341173a1555f
SHA512 0d5e0e6e1801953c194e020d2ac09ff636e15e285fa9b97473f62781780dd84c7652db729923e8b3ebe7381e7f90f4d0ca28a205cab3a30900c45a59efb4c57a
SSDEEP 49152:3wg9jdBjQTf79Xe//MTujnW3a/YV929DGFv49uMNCSVypctpmJXf2TBC8mmMYbTz:gBp3aXF3663uOPiWC+V9GOk
TLSH
T1AE669C03F2D641F9C09EC178C75B9237BB36B88A5625B29F1BD40B213E66FA05B0D749
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4015920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

client_lib.pdb

ole32

CoInitializeEx CoUninitialize

kernel32

IsProcessorFeaturePresent GetModuleHandleExW FlsFree FlsSetValue FlsGetValue FlsAlloc SetHandleInformation GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive Module32FirstW FindNextFileW CompareStringOrdinal GetFileSizeEx RtlLookupFunctionEntry RtlCaptureContext GetSystemTimePreciseAsFileTime RegisterWaitForSingleObject GetWindowsDirectoryW SetFileCompletionNotificationModes CreateIoCompletionPort GetCurrentThread LocalFree WaitForMultipleObjects Sleep SetEvent GetQueuedCompletionStatusEx PostQueuedCompletionStatus GetSystemDirectoryW FreeEnvironmentStringsW GlobalMemoryStatusEx K32GetPerformanceInfo LoadLibraryExW EncodePointer GetFileAttributesW SetWaitableTimer CreateWaitableTimerExW FormatMessageW InterlockedFlushSList GetACP GetExitCodeProcess CreateFileW GetConsoleOutputCP MultiByteToWideChar WaitForSingleObject GetCurrentProcessId GetSystemTimes GetProcessIoCounters RtlPcToFileHeader GetSystemTimeAsFileTime WriteConsoleW VirtualQueryEx GetFullPathNameW CancelIo WriteFile ReadProcessMemory DeviceIoControl Process32FirstW GetProcessTimes GetCPInfo SetStdHandle ReadFile UnregisterWaitEx WriteFileEx SleepEx ReadFileEx GetCurrentThreadId ExitProcess GetModuleFileNameW RtlVirtualUnwind GetTempPathW GetCurrentProcess GetFileType InitializeSListHead SetUnhandledExceptionFilter GetSystemInfo CreateThread CreateProcessW CreateEventA DeleteCriticalSection FindClose FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW RemoveDirectoryW GetFileInformationByHandle FlushFileBuffers SetFilePointerEx SwitchToThread LeaveCriticalSection EnterCriticalSection DuplicateHandle CreateSymbolicLinkW LoadLibraryW CreateDirectoryW MoveFileExW GetLastError InitializeCriticalSection GetEnvironmentStringsW GetCommandLineW Process32NextW QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW SetLastError ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte HeapReAlloc GetStringTypeW lstrlenW TerminateProcess RtlUnwindEx RaiseException SetFileInformationByHandle QueryPerformanceCounter GetOEMCP LockFileEx InitializeCriticalSectionEx GetTimeZoneInformationForYear GetStdHandle GetConsoleMode SetConsoleMode IsDebuggerPresent OpenProcess UnhandledExceptionFilter CloseHandle HeapAlloc HeapFree GetProcessHeap OutputDebugStringW VirtualProtect FreeLibrary GetProcAddress LoadLibraryExA CreateEventW Module32NextW HeapSize GetOverlappedResult GetCommandLineA CreateToolhelp32Snapshot LCMapStringW GetModuleHandleW IsValidCodePage GetFileInformationByHandleEx GetModuleHandleA

user32

GetWindowDC IsIconic UnhookWinEvent GetWindowThreadProcessId GetWindowTextLengthW CallNextHookEx AttachThreadInput GetForegroundWindow SetWindowsHookExA GetSystemMetrics GetWindowTextW EnumDisplayMonitors MonitorFromWindow MonitorFromPoint SetProcessDpiAwarenessContext IsWindow IsWindowVisible GetClassNameW GetWindowLongPtrW IsRectEmpty EnumDisplaySettingsW GetMonitorInfoW GetWindowInfo GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo GetDesktopWindow EnumWindows PrintWindow GetKeyState GetKeyboardState GetKeyboardLayout GetMessageA ToUnicodeEx SendInput SetWinEventHook ReleaseDC

shell32

SHGetKnownFolderPath ShellExecuteW ShellExecuteExW CommandLineToArgvW

combase

CoTaskMemFree CoCreateFreeThreadedMarshaler CoIncrementMTAUsage

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

d3d11

D3D11CreateDevice

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

ws2_32

setsockopt getsockopt closesocket send bind recv ioctlsocket shutdown WSAIoctl freeaddrinfo getpeername getsockname WSACleanup WSAStartup connect WSASend getaddrinfo WSASocketW WSAGetLastError

pdh

PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhRemoveCounter PdhCloseQuery PdhEnumObjectsA PdhCollectQueryData PdhOpenQueryA

ntdll

NtWriteFile NtQueryInformationProcess NtReadFile NtCreateNamedPipeFile NtOpenFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile RtlGetVersion

advapi32

OpenProcessToken SystemFunction036 RegGetValueW GetTokenInformation IsValidSid CopySid GetLengthSid

powrprof

CallNtPowerInformation

psapi

GetProcessMemoryInfo GetModuleFileNameExW

gdi32

CreateCompatibleBitmap BitBlt GetDIBits GetDeviceCaps CreateDCW DeleteDC DeleteObject SelectObject GetObjectW CreateCompatibleDC GetCurrentObject

dwmapi

DwmIsCompositionEnabled DwmGetWindowAttribute

crypt32

CertVerifyTimeValidity CertEnumCertificatesInStore CertGetEnhancedKeyUsage CertFreeCertificateContext CertDuplicateCertificateContext CertCloseStore CertOpenStore

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcrypt

BCryptGenRandom

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

867229653dbc23551c26223575a5158d9232202a8ee485f657a97a9f3301aef1

ole32

kernel32

user32

shell32

combase

api-ms-win-core-winrt-l1-1-0

d3d11

oleaut32

ws2_32

pdh

ntdll

advapi32

powrprof

psapi

gdi32

dwmapi

crypt32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

generic