4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499

Sharing

Copy URL Twitter E-mail

General

Target
4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499
Size 524KB
Sample260928-lltzlsaa98
SHA256 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499
MD5 ee797df97df1b7bf613caa703191aa47
SHA1 01a2afb841c2ca0fa54c420093890450e3213b1a
SHA512 2e62c109ad16a69bbe29396de529b02a54ce9944cf8e6065b250672c54ceb35100ab39d3671e76674834caf43cd3c9727d56f2daab0ef8aa267e3fefa151752b
SSDEEP 6144:JR+N8Zk5APw9J/ZWjnG0oXkBvLgvPXdFMYElH5OTU3lzHxGyKFC65autcfIXuxNe:JKF9J/ZWS2DgvPlEHzRGyKFzFMNkdcO
TLSH
T1ADB46D42E7D222ECE4B6C5309777913279727C810B31ADDF41849E3A2E61EC1AE39B57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499

File Explorer

4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499

.exe 524KB

4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499

IMPHASH 65a85d22abb3590aaf7f1671b548661b
SHA256 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499
MD5 ee797df97df1b7bf613caa703191aa47
SHA1 01a2afb841c2ca0fa54c420093890450e3213b1a
SHA512 2e62c109ad16a69bbe29396de529b02a54ce9944cf8e6065b250672c54ceb35100ab39d3671e76674834caf43cd3c9727d56f2daab0ef8aa267e3fefa151752b
SSDEEP 6144:JR+N8Zk5APw9J/ZWjnG0oXkBvLgvPXdFMYElH5OTU3lzHxGyKFC65autcfIXuxNe:JKF9J/ZWS2DgvPlEHzRGyKFzFMNkdcO
TLSH
T1ADB46D42E7D222ECE4B6C5309777913279727C810B31ADDF41849E3A2E61EC1AE39B57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

setupapi

CM_Disable_DevNode CM_Enable_DevNode CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key CM_Reenumerate_DevNode SetupCloseInfFile SetupCopyOEMInfW SetupDiBuildDriverInfoList SetupDiCallClassInstaller SetupDiCreateDeviceInfoList SetupDiDestroyClassImageList SetupDiDestroyDeviceInfoList SetupDiDestroyDriverInfoList SetupDiEnumDeviceInfo SetupDiEnumDriverInfoW SetupDiGetClassDescriptionW SetupDiGetClassDevsW SetupDiGetClassImageIndex SetupDiGetClassImageList SetupDiGetDeviceInstallParamsW SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiGetINFClassW SetupDiInstallDevice SetupDiLoadDeviceIcon SetupDiOpenDeviceInfoW SetupDiRemoveDevice SetupDiSetClassInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiSetSelectedDriverW SetupFindFirstLineW SetupGetStringFieldW SetupOpenInfFileW SetupUninstallOEMInfW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_GetIcon ImageList_GetImageCount ImageList_ReplaceIcon ImageList_SetOverlayImage InitCommonControlsEx

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextExtentPoint32W GetTextMetricsW LineTo MoveToEx Polyline SelectObject SetBkColor SetBkMode SetTextColor

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW ExtractIconExW SHBrowseForFolderW SHCreateShellItem SHFileOperationW SHGetPathFromIDListW SHParseDisplayName ShellExecuteW StrStrIW

ole32

CLSIDFromString CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize StringFromGUID2

shlwapi

PathFindExtensionW PathIsDirectoryW PathMatchSpecW SHLoadIndirectString

uxtheme

SetWindowTheme

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

iphlpapi

GetAdaptersAddresses

comdlg32

GetSaveFileNameW

advapi32

AdjustTokenPrivileges CloseServiceHandle LookupPrivilegeValueW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW StartServiceW SystemFunction036

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vswscanf _close _lseek _open _read _wopen _write fflush setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-string-l1-1-0

_stricmp _strnicmp _wcsicmp _wcsnicmp memset strlen towlower wcscmp wcscpy wcscpy_s wcslen wcsncmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strstr wcschr wcsrchr wcsstr

api-ms-win-crt-utility-l1-1-0

qsort rand_s

user32

AppendMenuW BeginPaint CallWindowProcW ChangeWindowMessageFilterEx ClientToScreen CloseClipboard CopyImage CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW DrawFrameControl DrawTextW EmptyClipboard EnableWindow EndDialog EndPaint EnumChildWindows FillRect FindWindowExW FrameRect GetAncestor GetClassNameW GetClientRect GetCursorPos GetDC GetDlgCtrlID GetDlgItem GetDlgItemTextW GetMessagePos GetMessageW GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindow GetWindowDC GetWindowLongPtrW GetWindowRect GetWindowTextW InflateRect InsertMenuItemW InvalidateRect IsDialogMessageW IsDlgButtonChecked IsWindowEnabled IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW LockWindowUpdate MapWindowPoints MessageBoxW OffsetRect OpenClipboard PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassW RegisterDeviceNotificationW ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendDlgItemMessageW SendMessageTimeoutW SendMessageW SetCapture SetClipboardData SetDlgItemTextW SetForegroundWindow SetMenuInfo SetProcessDPIAware SetPropW SetTimer SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMessage UnregisterDeviceNotification UpdateWindow wsprintfW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileMappingW CreateFileW CreatePipe CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetExitCodeProcess GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameW GetLastError GetLogicalDrives GetModuleFileNameW GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetShortPathNameW GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetTempPathW GetTickCount GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocalReAlloc MapViewOfFile MoveFileExW MulDiv MultiByteToWideChar ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW RemoveVectoredExceptionHandler SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile lstrcatW lstrcmpW lstrcmpiW lstrcpynW lstrlenW

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

Name

.text

Size

358KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499

setupapi

comctl32

gdi32

shell32

ole32

shlwapi

uxtheme

version

iphlpapi

comdlg32

advapi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic