77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc

Sharing

Copy URL Twitter E-mail

General

Target
77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc
Size 1.5MB
Sample260925-xcbbpatfrh
SHA256 77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc
MD5 0903984dbf2a326a2fa8ce6c34a65eb1
SHA1 4fdf0d3858acfc46fbf0f4ef97c2ff4fffdd37b9
SHA512 9202d4fa50081d84616628097d95def498b2b9b5f0b3df17cf6549cf83643516b6d84cff0f0626dffc53be80dc7e0482a4ea32e22cee5e0d05e2c62e82e56805
SSDEEP 24576:umJJS+GkDuiBkyuEhgA3PWabhLu8RT0/okZeUj4pT8Xbso6GXhPt:umu+GkaYuEhDPWa9il//ebUswh
TLSH
T1D2657D47B3B800B8D57BD278C9575A0BEBB17811177097DF66909A5A2F33BE11A3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc

File Explorer

77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc

.dll 1.5MB

77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc

IMPHASH 0339ea4163a811f16f7c62b98b34569e
SHA256 77797b0092c1664ad314c55fdc406366879af5d860b1840a1ce62aab74ff35bc
MD5 0903984dbf2a326a2fa8ce6c34a65eb1
SHA1 4fdf0d3858acfc46fbf0f4ef97c2ff4fffdd37b9
SHA512 9202d4fa50081d84616628097d95def498b2b9b5f0b3df17cf6549cf83643516b6d84cff0f0626dffc53be80dc7e0482a4ea32e22cee5e0d05e2c62e82e56805
SSDEEP 24576:umJJS+GkDuiBkyuEhgA3PWabhLu8RT0/okZeUj4pT8Xbso6GXhPt:umu+GkaYuEhDPWa9il//ebUswh
TLSH
T1D2657D47B3B800B8D57BD278C9575A0BEBB17811177097DF66909A5A2F33BE11A3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

905768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\edg\6.0.9\MonSafe\MonSafe\x64\Release\BoxFsSec64.pdb

kernel32

VirtualProtect CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep GetPrivateProfileStringW WritePrivateProfileStringW GetTempPathW GetEnvironmentVariableW GetComputerNameW GetCurrentThread HeapFree InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer HeapDestroy GetProcessHeap MulDiv GetLocalTime CreateProcessA GetCurrentProcess CreateDirectoryW CopyFileW WideCharToMultiByte GetACP OutputDebugStringA GetModuleHandleExW LoadLibraryW CreateActCtxW ActivateActCtx DeactivateActCtx FindActCtxSectionStringW QueryActCtxW LocalFree FormatMessageW GetCurrentThreadId GetVersionExW FreeLibrary LoadLibraryExW GlobalDeleteAtom lstrcmpA lstrcmpW WriteConsoleW SetStdHandle GetConsoleCP ReadConsoleW GetConsoleMode SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA EnumSystemLocalesW IsValidLocale GetFileType GetStdHandle GetTimeZoneInformation GetModuleFileNameA HeapQueryInformation GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx GetSystemTime FlushViewOfFile OpenFileMappingW CreateFileMappingW UnmapViewOfFile MapViewOfFile GetSystemInfo GetCommandLineW CreateMutexW GetProcessId GetVersionExA GetNativeSystemInfo SetFilePointerEx IsWow64Process WriteProcessMemory ReadProcessMemory VirtualAllocEx OpenProcess ExitProcess LoadLibraryExA VirtualQueryEx VirtualProtectEx VirtualQuery VirtualFree VirtualAlloc FlushInstructionCache SetThreadContext GetThreadContext GetCPInfo LCMapStringW GetTickCount SwitchToThread GetStringTypeW WaitForSingleObject CreateEventW DeleteCriticalSection InitializeCriticalSection GetDriveTypeW SetLastError OutputDebugStringW GlobalSize GetModuleFileNameW GetCurrentProcessId CloseHandle CreateFileW GlobalLock FindResourceW LoadResource LockResource SizeofResource GetLastError GlobalFree GlobalUnlock GlobalAlloc AreFileApisANSI TryEnterCriticalSection HeapCreate GetFullPathNameA UnlockFileEx HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA CreateFileA LoadLibraryA DeleteFileA HeapCompact CreateFileMappingA LockFileEx FormatMessageA RtlUnwind SuspendThread ResumeThread GetModuleHandleW GetProcAddress GetPrivateProfileIntW GlobalAddAtomW EncodePointer GetSystemDirectoryW GlobalFindAtomW CompareStringW EnterCriticalSection InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetUserDefaultLCID GetDiskFreeSpaceW SystemTimeToTzSpecificLocalTime GetFileAttributesExW GetFileAttributesW FileTimeToLocalFileTime WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers FindFirstFileW FindClose DeleteFileW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryW SystemTimeToFileTime FileTimeToSystemTime SetErrorMode LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc LeaveCriticalSection MultiByteToWideChar

user32

GetParent UnregisterClassW CreateWindowExW CreateWindowExA DrawTextW InternalGetWindowText CreateDialogParamW CreateDialogIndirectParamW EndDialog GetClientRect SetRectEmpty OffsetRect GetWindowRect ShowWindow GetFocus GetDesktopWindow IsWindow WindowFromDC UnhookWindowsHookEx GetSubMenu SetWindowsHookExW CallNextHookEx GetWindowThreadProcessId WindowFromPoint MessageBoxW GetCursorPos GetWindowTextW GetForegroundWindow RegisterClipboardFormatW CloseClipboard GetPriorityClipboardFormat IsClipboardFormatAvailable EnumClipboardFormats EmptyClipboard GetClipboardData DestroyWindow SetClipboardData DestroyMenu CharUpperW TabbedTextOutW GrayStringW OpenClipboard InvalidateRect KillTimer SetTimer RealChildWindowFromPoint ClientToScreen LoadCursorW GetSysColorBrush ReleaseDC GetDC GetSystemMetrics SetWindowTextW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient AdjustWindowRectEx RemovePropW GetPropW SetPropW RedrawWindow EndPaint BeginPaint SetForegroundWindow UpdateWindow SetMenu GetMenu GetCapture GetDlgCtrlID GetDlgItem IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos IsMenu GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos RegisterWindowMessageW GetWindow GetScrollPos GetLastActivePopup GetWindowLongW IsWindowEnabled EnableWindow SetCursor ValidateRect GetKeyState GetActiveWindow IsWindowVisible PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem SendMessageW PostQuitMessage PostMessageW GetMenuItemCount GetMenuItemID DrawTextExW

gdi32

BitBlt CreateCompatibleBitmap SelectObject GetObjectW DeleteDC ScaleWindowExtEx ScaleViewportExtEx OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx ExtTextOutW TextOutW SetMapMode DeleteObject RectVisible PtVisible GetClipBox Escape CreateBitmap EndPage StartPage EndDoc StartDocW RestoreDC SetBkColor SetTextColor SetBkMode SaveDC CreateFontIndirectW GetDeviceCaps StretchBlt DeleteEnhMetaFile SetEnhMetaFileBits GetDIBits GetStockObject GetEnhMetaFileBits CreateCompatibleDC

comdlg32

GetSaveFileNameW GetSaveFileNameA

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegEnumKeyW RegQueryValueW RegEnumValueW SetSecurityDescriptorDacl InitializeSecurityDescriptor

shell32

ShellExecuteW DragQueryFileW

shlwapi

StrStrIW StrStrIA PathIsDirectoryW PathFileExistsW PathFindExtensionW PathFindFileNameW PathIsNetworkPathW PathIsUNCW PathStripToRootW

ole32

CoUninitialize CoCreateGuid CoInitialize CoTaskMemFree CoCreateInstance DoDragDrop

ws2_32

inet_addr connect inet_ntoa

psapi

GetProcessImageFileNameW GetModuleFileNameExW

fltlib

FilterSendMessage FilterConnectCommunicationPort

iphlpapi

GetAdaptersInfo

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

298KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

MonClipS

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=13, id=241, version=40116,

count=188, id=243, version=40116,

count=26, id=242, version=40116,

count=1, productName=Unmarked objects (old),

count=4, id=261, version=27048,

count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, id=135, version=30729,

count=45, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=835, id=1, productName=Unmarked objects,

count=4, id=199, version=41118,

count=33, id=260, version=26706,

count=9, id=259, version=26706,

count=159, id=261, version=26706,

count=65, id=265, version=27054,

count=1, id=256, version=27054,

count=1, id=255, version=27054,

count=1, id=151,

count=1, id=258, version=27054,