178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b

Sharing

Copy URL Twitter E-mail

General

Target
178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b
Size 1.2MB
Sample260928-qyn2caba29
SHA256 178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b
MD5 52bd030547ad26347860e44bb1b56254
SHA1 f5b8fd1b1265367544f9546cd3899e8d14018ff9
SHA512 3193eb1e491fb6458582fb25bd8a55b8d1a35d4baf4073ee9c3a3a831581fa0904ad55963d306300e6d4f45ac5bf8e1c5f224830aeeb89ebfa146a289f057a6a
SSDEEP 24576:hrkRmtSgXqJ6jT9kTfP8cpw384F3/85RkV8vn+W:hGwSxJk9kTfkcpUF3UfkVS+W
TLSH
T185456A2176E58036F1B32731687C92649A3AFCB1993A850F73C8666D5F30A81CE35B77
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b

File Explorer

178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b

.exe 1.2MB

178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b

IMPHASH bae2db72126b04465d39009b50e7c569
SHA256 178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b
MD5 52bd030547ad26347860e44bb1b56254
SHA1 f5b8fd1b1265367544f9546cd3899e8d14018ff9
SHA512 3193eb1e491fb6458582fb25bd8a55b8d1a35d4baf4073ee9c3a3a831581fa0904ad55963d306300e6d4f45ac5bf8e1c5f224830aeeb89ebfa146a289f057a6a
SSDEEP 24576:hrkRmtSgXqJ6jT9kTfP8cpw384F3/85RkV8vn+W:hGwSxJk9kTfkcpUF3UfkVS+W
TLSH
T185456A2176E58036F1B32731687C92649A3AFCB1993A850F73C8666D5F30A81CE35B77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

326326

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoCreateInstance StringFromGUID2 IIDFromString OleUninitialize OleInitialize OleRun OleSetContainedObject CoInitializeEx CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize

shell32

ShellExecuteExA FindExecutableA Shell_NotifyIconA SHGetFolderPathW SHGetFolderPathA

wininet

InternetReadFile InternetTimeToSystemTime InternetCrackUrlA InternetTimeFromSystemTime InternetOpenA InternetCloseHandle InternetConnectA InternetGetConnectedState HttpOpenRequestA HttpSendRequestA HttpQueryInfoA InternetErrorDlg

user32

GetWindowThreadProcessId SetRect SetFocus IsChild GetAncestor GetFocus RegisterClassExA LoadCursorA GetParent MessageBoxW GetDesktopWindow SetWindowLongW GetWindowLongW AdjustWindowRectEx GetWindowRect LoadImageA SetWindowLongA GetClientRect GetWindowLongA ReleaseDC GetDC EnableMenuItem GetSystemMenu SetWindowPos CreateWindowExW GetClassInfoExW RegisterClassExW GetCursorPos CharNextA LoadStringA GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW PeekMessageA PostMessageA DefWindowProcA PostQuitMessage RegisterClassA wsprintfA CreateWindowExA DestroyWindow ShowWindow MsgWaitForMultipleObjectsEx IsWindowUnicode GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu SetWindowTextW DefWindowProcW SendMessageA SetForegroundWindow

comctl32

InitCommonControlsEx

version

GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeA

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW VirtualAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter VirtualProtect GetFileType SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetConsoleMode GetCommandLineW GetStdHandle GetModuleFileNameW WriteConsoleW ExitThread GetSystemInfo VirtualQuery GetDriveTypeW IsProcessorFeaturePresent GetFileInformationByHandle CreateDirectoryW SetStdHandle HeapAlloc HeapFree HeapSize HeapReAlloc FreeLibraryAndExitThread CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFullPathNameW FlushFileBuffers GetFileSizeEx ReadConsoleW GetTimeZoneInformation DecodePointer GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpA GetCommandLineA CloseHandle RaiseException CreateMutexA FreeLibrary GetModuleFileNameA GetModuleHandleA LoadLibraryExA LoadResource SizeofResource lstrcmpiA FindResourceA SetDllDirectoryA MultiByteToWideChar WideCharToMultiByte IsDBCSLeadByte DeleteFileA WaitForSingleObject GetExitCodeProcess LocalFree FormatMessageA lstrlenA SetEvent ResetEvent CreateEventA WaitForMultipleObjects CreateThread lstrcpyA lstrcatA lstrcpynA CreateFileA WriteFile OpenEventA Sleep GetSystemTime GetTempPathA GetCurrentProcess ReadFile FileTimeToSystemTime SystemTimeToFileTime MulDiv GetCurrentThreadId LocalAlloc GetCurrentProcessId GetLocalTime FormatMessageW GetEnvironmentVariableA FindClose FindFirstFileA ExitProcess TerminateProcess GetSystemDirectoryA GetWindowsDirectoryA LockResource SetEndOfFile SetFilePointerEx SetLastError GetNativeSystemInfo GetModuleHandleExW CreateDirectoryA FindNextFileA GetFileAttributesA RemoveDirectoryA SetFileAttributesA GetTickCount MoveFileExA SetHandleInformation CreatePipe PeekNamedPipe CreateProcessA GetCurrentDirectoryW GetThreadLocale GetUserDefaultUILanguage GetModuleHandleExA OpenThread GetExitCodeThread LoadLibraryW LoadLibraryExW OpenMutexA ReleaseMutex QueryPerformanceCounter QueryPerformanceFrequency CreateFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetProcAddress GetSystemDefaultUILanguage

advapi32

InitializeSecurityDescriptor RegSetValueExA RegQueryInfoKeyW RegOpenKeyExA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey RegQueryValueExA SetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegEnumKeyA

oleaut32

SysFreeString VarUI4FromStr VariantClear SysAllocString VariantInit VariantChangeType SysStringByteLen SysAllocStringByteLen GetErrorInfo VariantCopy

shlwapi

ord12

gdi32

GetStockObject GetDeviceCaps

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CryptMsgGetParam CertCloseStore CertFindCertificateInStore CertGetNameStringW CryptQueryObject CryptStringToBinaryA CryptBinaryToStringA CryptProtectData CryptUnprotectData

msi

ord189 ord168 ord137 ord117 ord31 ord159 ord160 ord91 ord115 ord44 ord141 ord8 ord67 ord204

Sharing

General

Malware Config

Signatures

File Explorer

178158bc6dc23ab2effd22dd75bcdd7ef1aa7c2182ae5924702582dc7d51a32b

ole32

shell32

wininet

user32

comctl32

version

kernel32

advapi32

oleaut32

shlwapi

gdi32

wintrust

crypt32

msi

generic