43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815

Sharing

Copy URL Twitter E-mail

General

Target
43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815
Size 3.3MB
Sample260928-gm2nmaxwhy
SHA256 43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815
MD5 865b379dcffe22ceccee2154fd404809
SHA1 0000bdd56386ee5612a26206b0bae2089e6bff04
SHA512 e919032fcf7ed009ebed25b1e004ea914f330b181213f6a459a2ee17f0a21501107fc483c58d798a325a449ce6a4d4bfc2b89a00bcb1c0fe428f8f8158b743a5
SSDEEP 98304:yirB3Y2YZIa0uEAM3/+ODLGEiEOg73rVcg+:tB3Y2mIZuEAM3/+Pg/V5+
TLSH
T19AF5B052F68390F2D6860471942F777B993C2A3A0344D9F3E3C46E65E821BC27A7674B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815

File Explorer

43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815

.exe 3.3MB

43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815

IMPHASH 308028803584d112a30374cd9b0919da
SHA256 43e155240e8bf2e5a817132c8ff6622fd061ded9fb29d6d23c1bb43b7c3b9815
MD5 865b379dcffe22ceccee2154fd404809
SHA1 0000bdd56386ee5612a26206b0bae2089e6bff04
SHA512 e919032fcf7ed009ebed25b1e004ea914f330b181213f6a459a2ee17f0a21501107fc483c58d798a325a449ce6a4d4bfc2b89a00bcb1c0fe428f8f8158b743a5
SSDEEP 98304:yirB3Y2YZIa0uEAM3/+ODLGEiEOg73rVcg+:tB3Y2mIZuEAM3/+Pg/V5+
TLSH
T19AF5B052F68390F2D6860471942F777B993C2A3A0344D9F3E3C46E65E821BC27A7674B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

805016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount LocalAlloc LocalReAlloc lstrcpynA lstrcpyA lstrcatA lstrlenA GetLogicalDriveStringsA MoveFileA MultiByteToWideChar CancelIo GetFileSizeEx SetFileAttributesA GetTempPathA GetExitCodeProcess CreateRemoteThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx IsWow64Process GetProcAddress GlobalAlloc GlobalFree OpenMutexA MoveFileExA CreateToolhelp32Snapshot Process32First Process32Next GlobalSize OpenEventA GetProcessTimes GlobalMemoryStatusEx FreeLibrary LoadLibraryA GetCurrentThreadId GetWindowsDirectoryA IsBadReadPtr LocalSize IsProcessorFeaturePresent GetModuleHandleW FormatMessageA lstrcmpA QueryFullProcessImageNameA DisconnectNamedPipe PeekNamedPipe GetSystemDirectoryA CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetSystemDirectoryW GetCurrentDirectoryW HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetFileAttributesExW ReadConsoleW GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc MoveFileExW GetTimeZoneInformation FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetCommandLineW GetCommandLineA ExitProcess FreeLibraryAndExitThread ExitThread GetModuleHandleExW GetModuleFileNameW GetFileType LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind GetThreadPriority SetThreadPriority LoadLibraryW GetProcessAffinityMask CreateSemaphoreW CreateEventW ReleaseSemaphore InitializeCriticalSectionAndSpinCount WriteConsoleW GetConsoleMode GetStdHandle FlushFileBuffers SetFilePointerEx DeleteFileW GetCurrentThread RaiseFailFastException GetFileAttributesW CreateFileW SetEndOfFile FindNextFileW FindFirstFileW CreateDirectoryW SleepConditionVariableCS InitializeConditionVariable OutputDebugStringW GetStringTypeW GetCPInfo CompareStringEx GetTempPathW LCMapStringEx EncodePointer RaiseException InitOnceComplete RemoveDirectoryA GetFileAttributesExA GetDriveTypeA GetDiskFreeSpaceExA DeleteFileA CreateDirectoryA ExpandEnvironmentStringsA SetConsoleCtrlHandler WTSGetActiveConsoleSessionId WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA SetThreadExecutionState LocalFree GetModuleHandleA GetModuleFileNameA GetTickCount64 GetLocalTime ProcessIdToSessionId CreateThread CreateMutexA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError VirtualFree VirtualAlloc GetNativeSystemInfo GetVersionExA ResumeThread TerminateThread GetCurrentProcessId CreateEventA SetEvent GetEnvironmentVariableA GetComputerNameA CreateProcessA TerminateProcess GetCurrentProcess Sleep WaitForSingleObject GetProcessHeap HeapFree HeapAlloc CreatePipe CloseHandle GetVolumeInformationA WriteFile ReadFile GetFileSize CreateFileA WideCharToMultiByte GlobalLock GlobalUnlock DeleteCriticalSection InitializeCriticalSectionEx GetLastError DecodePointer GetFileAttributesA InitOnceBeginInitialize WakeConditionVariable TryAcquireSRWLockExclusive GetExitCodeThread WaitForSingleObjectEx QueryPerformanceFrequency GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime VirtualProtect QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive SetFilePointer FindClose FindFirstFileA FindNextFileA

user32

EmptyClipboard SendInput GetLastInputInfo GetWindowTextA SetThreadDesktop PeekMessageA SendMessageA IsClipboardFormatAvailable GetKeyState GetKeyboardLayout MapVirtualKeyExA GetWindowThreadProcessId SetWindowsHookExA UnhookWindowsHookEx CallNextHookEx GetSystemMetrics GetMonitorInfoA EnumDisplayMonitors OpenDesktopA GetThreadDesktop OpenWindowStationA SetProcessWindowStation CreateDesktopA EnumDesktopWindows PostMessageA ExitWindowsEx ShowWindow SetWindowPos GetWindowPlacement SetClipboardData CloseDesktop OpenInputDesktop CharNextA MessageBoxA CharLowerA GetClientRect IsWindowVisible CreateWindowExA IsIconic BringWindowToTop keybd_event mouse_event MapVirtualKeyA ReleaseCapture GetMenuItemID MenuItemFromPoint SetForegroundWindow AllowSetForegroundWindow GetDC ReleaseDC GetWindowRect SetCursorPos GetCursorPos ScreenToClient WindowFromPoint ChildWindowFromPoint DispatchMessageA TranslateMessage GetMessageA PtInRect GetClipboardData CloseClipboard GetUserObjectInformationA GetClassNameA EnumWindows FindWindowExA FindWindowA GetWindowLongA SetWindowLongA GetDesktopWindow GetParent GetWindow LoadCursorA DrawIconEx OpenClipboard GetForegroundWindow GetClassNameW GetShellWindow AttachThreadInput EnumDisplaySettingsA SystemParametersInfoA LoadIconA KillTimer SetTimer SetFocus SetDlgItemTextA EndDialog DialogBoxParamA MoveWindow IsZoomed GetTopWindow FillRect RedrawWindow PrintWindow SendMessageTimeoutA RealGetWindowClassA GetAncestor GetCursorInfo BlockInput GetIconInfo

gdi32

BitBlt CreateCompatibleDC DeleteDC CreateSolidBrush CreateCompatibleBitmap GetObjectA CreateDIBSection SelectObject DeleteObject

advapi32

ControlService RegCloseKey RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CreateProcessAsUserA StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA QueryServiceStatusEx QueryServiceStatus DeleteService CreateServiceA ChangeServiceConfig2A UnlockServiceDatabase StartServiceA QueryServiceConfigA OpenServiceA OpenSCManagerA LockServiceDatabase EnumServicesStatusA CryptReleaseContext CloseServiceHandle ChangeServiceConfigA CreateWellKnownSid ConvertStringSidToSidW EqualSid RegQueryInfoKeyA RegEnumValueA RegEnumKeyExA RegOpenKeyA GetUserNameA CreateProcessWithTokenW LookupPrivilegeValueA FreeSid DuplicateTokenEx CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken RegQueryValueA ConvertSidToStringSidA RegSetValueExA RegCreateKeyExA GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam

shell32

ord43 SHGetFileInfoA SHCreateDirectoryExW SHGetFolderPathA SHGetPathFromIDListA ShellExecuteA DragQueryFileA

ole32

CoTaskMemFree CoInitializeEx CoCreateInstance CoInitialize CoUninitialize ReleaseStgMedium

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

shlwapi

PathRemoveFileSpecA

bcrypt

BCryptCloseAlgorithmProvider BCryptGetProperty BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptOpenAlgorithmProvider BCryptVerifySignature BCryptDestroyKey BCryptImportKeyPair

winmm

waveOutReset waveInOpen waveInClose waveInPrepareHeader timeEndPeriod waveInAddBuffer waveInStart waveInStop waveOutWrite waveOutUnprepareHeader PlaySoundA waveInUnprepareHeader waveOutGetNumDevs waveOutOpen waveOutClose waveOutPrepareHeader waveInReset waveInGetNumDevs timeBeginPeriod

ws2_32

getaddrinfo freeaddrinfo __WSAFDIsSet closesocket connect getsockname gethostname inet_ntop ntohs ntohl recvfrom sendto inet_pton WSAIoctl WSAGetLastError WSACleanup WSAStartup gethostbyname socket ioctlsocket send select recv inet_ntoa inet_addr htons getsockopt setsockopt

avicap32

capGetDriverDescriptionA

msvfw32

ICSendMessage ICSeqCompressFrameStart ICSeqCompressFrameEnd ICSeqCompressFrame ICClose ICOpen ICCompressorFree

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsA WTSFreeMemory

iphlpapi

SetTcpEntry GetExtendedTcpTable

dwmapi

DwmGetWindowAttribute

urlmon

URLDownloadToFileA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

psapi

EnumProcessModules GetModuleFileNameExA

Name

.jxc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.jxe

Size

512B

Virtual Size

446B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

114KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jxd

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=34, id=259, version=33145,

count=207, id=261, version=33145,

count=26, productName=Unmarked objects (old),

count=60, id=260, version=35219,

count=15, id=261, version=30157,

count=140, id=260, version=35725,

count=3, id=265, version=35229,

count=25, id=260, version=30159,

count=2, id=253, version=35207,

count=31, id=259, version=35207,

count=18, id=260, version=35207,

count=97, id=261, version=35207,

count=46, id=260, version=33145,

count=2, id=262, version=33145,

count=43, id=257, version=33145,

count=503, id=1, productName=Unmarked objects,

count=7, id=260, version=35229,

count=34, id=261, version=35229,

count=1, id=255, version=35229,

count=1, id=151,

count=1, id=258, version=35229,