d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4

Sharing

Copy URL Twitter E-mail

General

Target
d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4
Size 762KB
Sample260926-s2ryhsxtdv
SHA256 d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4
MD5 bea4e38c74bababdb00c7d29b1eff020
SHA1 4f8a215a352e6f41bbd6984675fba0776f63bdc2
SHA512 243a9e329474d692c76cc940f612f6f0027a8ab0cc9eede70d918aa7364f7ee363a1ebd3260bd26ce1b341332f29a36e1525eeb5a99d1b9a20b3e5c898ec4279
SSDEEP 12288:4YC2dS4pWXm+l3DtmxdKDKQ226e7H1KlpTIRcxj5uIPrl1muEoGOh68xjeie76EO:4Yts4elhmTKDuNe7H1KlpTIRcxjYYrlZ
TLSH
T16BF44AA3F2939CDEC61A82384E9BC378533DBD601761A707092975353F379D09EAB681
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4

File Explorer

d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4

.exe 762KB

d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4

IMPHASH cb5d0cb0a87fc802a2ff80b849ab2556
SHA256 d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4
MD5 bea4e38c74bababdb00c7d29b1eff020
SHA1 4f8a215a352e6f41bbd6984675fba0776f63bdc2
SHA512 243a9e329474d692c76cc940f612f6f0027a8ab0cc9eede70d918aa7364f7ee363a1ebd3260bd26ce1b341332f29a36e1525eeb5a99d1b9a20b3e5c898ec4279
SSDEEP 12288:4YC2dS4pWXm+l3DtmxdKDKQ226e7H1KlpTIRcxj5uIPrl1muEoGOh68xjeie76EO:4Yts4elhmTKDuNe7H1KlpTIRcxjYYrlZ
TLSH
T16BF44AA3F2939CDEC61A82384E9BC378533DBD601761A707092975353F379D09EAB681
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSetProperty

comctl32

InitCommonControlsEx TaskDialogIndirect

crypt32

CryptBinaryToStringA CryptEncodeObjectEx CryptExportPublicKeyInfoFromBCryptKeyHandle CryptProtectData CryptStringToBinaryA CryptUnprotectData

gdi32

CreateFontA DeleteObject SetBkMode SetTextColor

imm32

ImmAssociateContext

kernel32

CloseHandle CreateMutexA CreateThread DeleteCriticalSection EnterCriticalSection ExitProcess FindResourceA GetLastError GetModuleHandleA GetStartupInfoA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadResource LocalFree LockResource MultiByteToWideChar SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

_itoa atoi atol strtod strtol strtoull

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcmp memcpy memmove strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf fflush puts setvbuf

api-ms-win-crt-string-l1-1-0

_strdup isalnum isalpha isspace isxdigit memset strcmp strcpy strcpy_s strlen strncmp strncpy strncpy_s strtok tolower wcslen

api-ms-win-crt-time-l1-1-0

_difftime64 _time64

shell32

ShellExecuteW

user32

AdjustWindowRect CallWindowProcA CreateWindowExA DefWindowProcA DialogBoxParamA DispatchMessageA EnableWindow EndDialog EnumChildWindows FindWindowA GetComboBoxInfo GetCursorPos GetDlgCtrlID GetDlgItem GetDlgItemTextA GetMessageA GetSysColorBrush GetWindowLongPtrA GetWindowRect GetWindowTextA GetWindowTextLengthA InvalidateRect IsDialogMessageA IsDlgButtonChecked IsIconic LoadCursorA LoadIconA MessageBeep MessageBoxA MoveWindow PostMessageA PostQuitMessage RedrawWindow RegisterClassA RegisterClassExA ScreenToClient SendDlgItemMessageA SendMessageA SetDlgItemTextA SetFocus SetForegroundWindow SetProcessDPIAware SetWindowLongPtrA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TranslateMessage UpdateWindow

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo getsockname inet_ntoa recv select send setsockopt socket

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1024B

Virtual Size

900B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d9980898dcfe759155c252d10d93b26df76b201c3bfdd834e0dc7df3f48063f4

advapi32

bcrypt

comctl32

crypt32

gdi32

imm32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

shell32

user32

winhttp

ws2_32

generic