99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7

Sharing

Copy URL Twitter E-mail

General

Target
99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7
Size 2.6MB
Sample260925-xbs54svt2l
SHA256 99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7
MD5 0ae51119b637e5c304de9f665c6ed23c
SHA1 68d4b420aa6207d54e761fb658bfcfe837f64856
SHA512 b04de7b3a5c735a015b9870ff57d885d2714330cabe886adb767b9d9a7e8e26465fb5cfb72d28a24fa2aabfd2e5273997ca2ab18f27852072c1af194452a11de
SSDEEP 49152:b8NbODE9Wh+NYKj7y9AYcLMoLJPOeFUowtTePmBkXG0rfLT/+FPIccZt4itp:b8NbbWhoYKj7y9AYyrLNOeUowtiPm4GJ
TLSH
T13BC5BE22FE919033E4EA0171A2FE5BF64DBD9734037494D3A39058B92D740D2BB3979A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7

File Explorer

99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7

.dll 2.6MB

99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7

IMPHASH 8278f22ce693394837784c0777666df6
SHA256 99ce7ae44c47293e1129f60000e3508dee013aafd939aca3c6e4c76076ca0bb7
MD5 0ae51119b637e5c304de9f665c6ed23c
SHA1 68d4b420aa6207d54e761fb658bfcfe837f64856
SHA512 b04de7b3a5c735a015b9870ff57d885d2714330cabe886adb767b9d9a7e8e26465fb5cfb72d28a24fa2aabfd2e5273997ca2ab18f27852072c1af194452a11de
SSDEEP 49152:b8NbODE9Wh+NYKj7y9AYcLMoLJPOeFUowtTePmBkXG0rfLT/+FPIccZt4itp:b8NbbWhoYKj7y9AYyrLNOeUowtiPm4GJ
TLSH
T13BC5BE22FE919033E4EA0171A2FE5BF64DBD9734037494D3A39058B92D740D2BB3979A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1560407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetUserDefaultLCID VirtualProtect GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryW SystemTimeToTzSpecificLocalTime ConvertThreadToFiber ConvertFiberToThread CreateFiber SwitchToFiber DeleteFiber InterlockedExchangeAdd InterlockedCompareExchange ReadConsoleA SetConsoleMode GetEnvironmentVariableW GetStartupInfoW QueryPerformanceCounter LoadLibraryExA VirtualQuery GetSystemInfo WriteConsoleW SetConsoleCtrlHandler SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExA EnumSystemLocalesW IsValidLocale GetSystemTimeAsFileTime MoveFileExW GetTimeZoneInformation GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx GetModuleFileNameA ExitProcess HeapQueryInformation GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread GetCommandLineW GetCommandLineA SetStdHandle InterlockedFlushSList RtlUnwind CreateDirectoryW GetSystemTime GetDriveTypeW VerifyVersionInfoW ExpandEnvironmentStringsA PeekNamedPipe GetStdHandle GetFileType WaitForMultipleObjects SleepEx FormatMessageA GetCPInfo GetStringTypeW LCMapStringW SwitchToThread QueryPerformanceFrequency GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FileTimeToLocalFileTime GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose CreateFileW SystemTimeToFileTime FileTimeToSystemTime SetErrorMode LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CompareStringW GlobalFindAtomW LoadLibraryA GetSystemDirectoryW EncodePointer GetCurrentProcessId GlobalAddAtomW WritePrivateProfileStringW CreateEventW WaitForSingleObject CloseHandle lstrcmpW lstrcmpA GlobalDeleteAtom LoadLibraryExW FreeLibrary GetVersionExW GetCurrentThreadId GetCurrentThread FormatMessageW LocalFree GlobalFree GlobalUnlock GlobalLock WideCharToMultiByte GlobalAlloc LoadLibraryW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW SetLastError GetACP GetLocalTime Sleep GetWindowsDirectoryW GetLogicalDriveStringsW GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount HeapFree OutputDebugStringW DeleteFileW CopyFileW GetTickCount GetLastError GetPrivateProfileIntW GetPrivateProfileStringW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar OutputDebugStringA InitializeSListHead

user32

CopyRect PtInRect SetWindowLongW GetClassLongW GetClassNameW GetTopWindow UnhookWindowsHookEx LoadIconW WinHelpW MonitorFromWindow GetMonitorInfoW RealChildWindowFromPoint IsWindowVisible GetActiveWindow GetKeyState ValidateRect ShowWindow DispatchMessageW TranslateMessage SetTimer UnregisterClassW GetClientRect SetRectEmpty OffsetRect GetParent GetMessageW LoadBitmapW GetSubMenu GetMenuItemID GetMenuItemCount PostMessageW PostQuitMessage SendMessageW GetFocus CheckMenuItem EnableMenuItem KillTimer InvalidateRect DrawTextW DrawTextExW GrayStringW TabbedTextOutW DestroyMenu SetMenuItemInfoW SetMenuItemBitmaps GetCursorPos GetMenuCheckMarkDimensions SetWindowTextW GetSystemMetrics GetDC ReleaseDC GetSysColorBrush LoadCursorW CharUpperW ClientToScreen PeekMessageW GetUserObjectInformationW GetProcessWindowStation GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx GetWindowRect RemovePropW GetPropW SetPropW RedrawWindow EndPaint BeginPaint SetForegroundWindow GetForegroundWindow UpdateWindow SetMenu GetMenu GetCapture GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos DestroyWindow IsMenu IsWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW GetWindow GetWindowTextW GetScrollPos GetLastActivePopup GetWindowThreadProcessId GetWindowLongW MessageBoxW IsWindowEnabled EnableWindow SetCursor CallNextHookEx SetWindowsHookExW

gdi32

SetMapMode TextOutW ExtTextOutW SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx SaveDC RestoreDC RectVisible PtVisible GetDeviceCaps CreateBitmap SetBkColor SetTextColor DeleteObject DeleteDC Escape GetClipBox GetStockObject SetViewportExtEx SelectObject

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

ReportEventW RegQueryValueExW RegCloseKey GetUserNameW RegCreateKeyExW RegDeleteKeyW CryptDestroyKey CryptGetUserKey CryptEnumProvidersW CryptDecrypt CryptExportKey CryptCreateHash CryptSetHashParam CryptDestroyHash CryptSignHashW CryptGetProvParam DeregisterEventSource RegisterEventSourceW RegOpenKeyExW CryptAcquireContextW CryptGenRandom CryptReleaseContext RegDeleteValueW RegEnumValueW RegQueryValueW RegEnumKeyW RegSetValueExW

shell32

ShellExecuteW

shlwapi

PathFindExtensionW PathFindFileNameW PathIsUNCW PathStripToRootW PathFileExistsW

ole32

CoInitialize CoCreateInstance CoCreateGuid CoUninitialize CoTaskMemFree

oleaut32

VariantChangeType VariantClear VariantInit SysAllocString SysFreeString

ws2_32

gethostname ioctlsocket listen accept sendto recvfrom freeaddrinfo getaddrinfo WSAIoctl setsockopt ntohs htons getsockopt getsockname gethostbyname inet_ntoa getnameinfo getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket WSAGetLastError WSACleanup WSAStartup shutdown

ntdll

VerSetConditionMask

safebase

encode_base64 Utf82Uni CheckFileDirs CreateDirs ord14 GetMD5Value SafeBase_free ParseFileName RunProcess GetWindowsEdition Is64BitOS GetInstPath QueryRegValue RegisterCOM GetWorkDirectory GetComputerUUID GetMACIPAddr GetLocalMACIPAddr Hex2Str GetSHA1Str

oleacc

LresultFromObject CreateStdAccessibleObject

wldap32

ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord118 ord41 ord208 ord216 ord14 ord46 ord145

crypt32

CertEnumCertificatesInStore CertDuplicateCertificateContext CertCloseStore CertFindCertificateInStore CertOpenStore CertGetCertificateContextProperty CertFreeCertificateContext

??0CCurlHttp@@QAE@ABV0@@Z ??0CCurlHttp@@QAE@XZ ??1CCurlHttp@@QAE@XZ ??4CCurlHttp@@QAEAAV0@ABV0@@Z ?DownLoadFile@CCurlHttp@@QAEHPADPBDPB_W@Z ?HttpDeleteFile@CCurlHttp@@QAE?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@00@Z ?HttpDownLoadFile@CCurlHttp@@QAE?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@000@Z ?HttpRenameFile@CCurlHttp@@QAE?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@00@Z ?HttpUploadBoxFile@CCurlHttp@@QAEHV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@0V?$vector@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@std@@@std@@0P6AHPAX_J333@ZP6AI2IIPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@ZP6AXHHHH0@Z@Z ?HttpUploadFile@CCurlHttp@@QAE?AV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@V23@000@Z ?InitHttpHead@CCurlHttp@@AAEHPAPAUcurl_slist@@PADHH@Z ?IsServerAvailable@CCurlHttp@@QAE_NABV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@J@Z ?PostRequestTransfer@CCurlHttp@@QAE_NV?$CStringT@_WV?$StrTraitMFC@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@HABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@P6AIPAXIIPAV45@@ZP6AXHHHH0@Z@Z ?RequestServer@CCurlHttp@@QAEPA_WPAD0PBD0@Z ?SendServer@CCurlHttp@@QAEPA_WPADPBDH0H@Z ?SendServerFile@CCurlHttp@@QAEPA_WPADPBDPAU_DocFileList@@IP6AHPAXNNNN@Z30H@Z ?SendServerLogFile@CCurlHttp@@QAEHPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAD@Z ?SetHttpTermInfo@CCurlHttp@@QAEXPAU_Terminal_Info@@@Z ?__autoclassinit2@CCurlHttp@@QAEXI@Z ?dnslookup@CCurlHttp@@AAEHPAUin_addr@@PBD@Z ?set_curl_resolve@CCurlHttp@@AAEXPAXPBDHPAPAUcurl_slist@@@Z ?stop_transfer@CCurlHttp@@QAEXXZ CheckBoxSafeDriver CheckMonSafeDriver GenShieldUUID GetBoxViewRoot GetDecryptBakRoot GetSharedValue GetShieldRoot GetUserConfigRoot InitDbgFileName InitLogFileName RegOverlayIcon SetSharedValue ShieldBase_free download_file http_get

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

576KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

MonShiel

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=18, id=241, version=40116,

count=195, id=243, version=40116,

count=29, id=242, version=40116,

count=2, id=257, version=27054,

count=6, id=199, version=41118,

count=87, id=260, version=27048,

count=21, productName=Unmarked objects (old),

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=35, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=694, id=1, productName=Unmarked objects,

count=34, id=260, version=26706,

count=28, id=259, version=26706,

count=149, id=261, version=26706,

count=577, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,