GoogleAdsSpainWinRarT1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
GoogleAdsSpainWinRarT1.exe
Size 3.1MB
Sample260928-ph79lsvsfw
SHA256 f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b
MD5 b507f957d814d58e9a9290e12a1b8dc4
SHA1 e684e742b6c3bf1f44ee9659bf6e1bfa4f2cddef
SHA512 6c1ce6fabd00a655be50508ba4d9b3fa4c727b97c60f6fcabd09439edbab1e820cdc0d4877526939604564bd9d50e0a898f80532393a8d23c70698d48ed76a20
SSDEEP 49152:x2JzNh2hpnzsQcooItwqqnSie8n8tCRIfgRTua+teofGDCZv3zuaN1ZHiHhPyQUl:xmIscdYUDkNg
TLSH
T1D8E58D09A3A900E9E027C17CCA578617EB72B40513359AFB5A928D573F23BF1673E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GoogleAdsSpainWinRarT1.exe

File Explorer

GoogleAdsSpainWinRarT1.exe

.exe 3.1MB

GoogleAdsSpainWinRarT1.exe

IMPHASH ef1e7cc915fc7c39116df28b9a95c3f7
SHA256 f6e71c379e3c0b25b7be83b78f19e2950c8ee1dcc3829ca44b42099e4c9e194b
MD5 b507f957d814d58e9a9290e12a1b8dc4
SHA1 e684e742b6c3bf1f44ee9659bf6e1bfa4f2cddef
SHA512 6c1ce6fabd00a655be50508ba4d9b3fa4c727b97c60f6fcabd09439edbab1e820cdc0d4877526939604564bd9d50e0a898f80532393a8d23c70698d48ed76a20
SSDEEP 49152:x2JzNh2hpnzsQcooItwqqnSie8n8tCRIfgRTua+teofGDCZv3zuaN1ZHiHhPyQUl:xmIscdYUDkNg
TLSH
T1D8E58D09A3A900E9E027C17CCA578617EB72B40513359AFB5A928D573F23BF1673E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1627696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError GetFileAttributesA Process32NextW MoveFileExA CreateFileA GetSystemDirectoryA SetDllDirectoryA LoadLibraryA DeleteFileA GlobalAlloc Process32FirstW GlobalFree CloseHandle CreateThread GetWindowsDirectoryA HeapAlloc GetLocalTime GetLogicalDriveStringsA VirtualProtectEx GetProcAddress GlobalLock SetFilePointerEx VirtualAllocEx LocalFree GetFileSize RemoveDirectoryA ExitProcess ReadProcessMemory GetCurrentProcessId GetProcessHeap CreateProcessW FreeLibrary WideCharToMultiByte CreateRemoteThread QueryFullProcessImageNameW CreateProcessA GetFileType GetDiskFreeSpaceExA CreateDirectoryA GetTempFileNameA GetTickCount GlobalUnlock ConnectNamedPipe VirtualQueryEx GetComputerNameA GetExitCodeProcess FlushFileBuffers QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo HeapReAlloc DeleteFileW WaitForSingleObjectEx FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetDiskFreeSpaceA FormatMessageW HeapSize HeapValidate UnmapViewOfFile CreateFileW UnlockFileEx SetEndOfFile SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetTickCount64 HeapCreate AreFileApisANSI RaiseException WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage SetStdHandle GetCurrentDirectoryW ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetTempPathA GetFinalPathNameByHandleA Sleep MultiByteToWideChar ReadFile CreateEventW CreateToolhelp32Snapshot OpenProcess GetModuleHandleA DuplicateHandle CopyFileA GetSystemDirectoryW ReleaseMutex lstrcmpA GetCurrentThreadId GetFileAttributesW WaitForSingleObject GetVolumeInformationA FindClose GetEnvironmentVariableA CreateMutexW GetTempPathW PeekNamedPipe GetFullPathNameA ExpandEnvironmentStringsA CreatePipe FindNextFileA CreateNamedPipeW GetDriveTypeA TerminateProcess WriteFile GetCurrentProcess HeapFree FindFirstFileA SetHandleInformation WriteProcessMemory InitializeSListHead GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer GetFileSizeEx CancelIo GetModuleFileNameA GetFullPathNameW EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetExitCodeThread AcquireSRWLockExclusive ReleaseSRWLockExclusive

user32

PostThreadMessageW PrintWindow CreateDesktopA wsprintfW SetClipboardData SendMessageA EnumDesktopWindows TranslateMessage OpenInputDesktop SetFocus UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx MapVirtualKeyA GetKeyboardLayout DrawIconEx GetWindowTextA PeekMessageW SetWindowsHookExA EmptyClipboard CloseClipboard GetCursorInfo DispatchMessageW OpenClipboard CloseDesktop GetAsyncKeyState IsWindow wsprintfA GetKeyboardState MenuItemFromPoint SetForegroundWindow GetAncestor SetCursorPos ReleaseDC GetThreadDesktop SetThreadDesktop GetWindowPlacement WindowFromPoint ChildWindowFromPointEx GetClassNameA GetSystemMetrics RealGetWindowClassA SendInput GetWindowLongA CallNextHookEx GetWindowThreadProcessId GetKeyState MapVirtualKeyW EnumDisplayDevicesA GetLastInputInfo GetWindowRect GetDC IsWindowVisible PostMessageA FillRect ScreenToClient

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt DeleteDC SetStretchBltMode DeleteObject CreateSolidBrush GetDeviceCaps

advapi32

RegCreateKeyExA RegEnumKeyExA RegQueryValueExW DuplicateTokenEx RegEnumValueA AdjustTokenPrivileges CryptAcquireContextA RevertToSelf RegCloseKey RegDeleteKeyA RegQueryValueExA CryptGenRandom AllocateAndInitializeSid LookupPrivilegeValueA CryptReleaseContext GetUserNameA ImpersonateLoggedOnUser RegSetValueExA OpenProcessToken FreeSid RegQueryInfoKeyA CheckTokenMembership RegOpenKeyExA RegOpenKeyExW

shell32

SHGetFolderPathA SHGetFolderPathW

ole32

CreateStreamOnHGlobal CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance CoCreateGuid

oleaut32

VariantInit VariantClear SysAllocString SysFreeString

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptGenerateSymmetricKey BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDestroyKey

ncrypt

NCryptFreeBuffer NCryptOpenStorageProvider NCryptEnumKeys NCryptDecrypt NCryptFreeObject NCryptOpenKey

gdiplus

GdiplusShutdown GdipGetImageEncoders GdipAlloc GdiplusStartup GdipCloneImage GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipCreateBitmapFromHBITMAP GdipDisposeImage

ws2_32

WSAGetLastError setsockopt ioctlsocket freeaddrinfo htons htonl recv connect socket send WSAStartup getaddrinfo ntohl select closesocket __WSAFDIsSet WSACleanup

Name

m85zows

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

sl22hqh

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_u41_tb

Size

20KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ewta28s

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

toctveh

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

a5qdp8l

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

jedrzhv

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

GoogleAdsSpainWinRarT1.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

crypt32

bcrypt

ncrypt

gdiplus

ws2_32

generic