9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e

Sharing

Copy URL Twitter E-mail

General

Target
9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e
Size 220KB
Sample260930-ayppwayt5k
SHA256 9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e
MD5 8e98124e6109a0d046b94898b5f7c9bc
SHA1 adfd5079f1201a388dd6d14e99a6dfbd2179bb30
SHA512 b94400418f3ecda60a98b7df957f9102a45a9be5b6cc3d611ca30b66dbe9e8b85a515d7733dc2c11c013884b38b7327a78c0d5535942e353e07f9660a575eb07
SSDEEP 3072:ChpKSXKP85CiQiJ6JW9JeBlmzT6WjLUYz5J0fEy:pW5rXd9kGzpn5J0fE
TLSH
T1B124B54073EA5615F6B747306CFE62616A36BC226F73C6CF6600212D1DB27E1AE74362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e

File Explorer

9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e

.dll 220KB

9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e

IMPHASH a0d52830c1f9f5fd42a41eac92b791f9
SHA256 9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e
MD5 8e98124e6109a0d046b94898b5f7c9bc
SHA1 adfd5079f1201a388dd6d14e99a6dfbd2179bb30
SHA512 b94400418f3ecda60a98b7df957f9102a45a9be5b6cc3d611ca30b66dbe9e8b85a515d7733dc2c11c013884b38b7327a78c0d5535942e353e07f9660a575eb07
SSDEEP 3072:ChpKSXKP85CiQiJ6JW9JeBlmzT6WjLUYz5J0fEy:pW5rXd9kGzpn5J0fE
TLSH
T1B124B54073EA5615F6B747306CFE62616A36BC226F73C6CF6600212D1DB27E1AE74362
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

BSTR_UserFree BSTR_UserMarshal BSTR_UserSize BSTR_UserUnmarshal SysAllocString SysAllocStringLen VARIANT_UserFree VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VariantClear VariantInit

ole32

CoMarshalInterface CoReleaseMarshalData CoUnmarshalInterface CreateStreamOnHGlobal HMENU_UserFree HMENU_UserMarshal HMENU_UserSize HMENU_UserUnmarshal HWND_UserFree HWND_UserMarshal HWND_UserSize HWND_UserUnmarshal

user32

ChildWindowFromPointEx ClientToScreen GetAncestor GetClientRect GetGUIThreadInfo GetWindow GetWindowLongW GetWindowThreadProcessId IsChild IsWindow IsWindowVisible LoadStringA LoadStringW MapWindowPoints RealGetWindowClassW ScreenToClient SendMessageW WindowFromPoint

rpcrt4

CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_QueryInterface IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrCStdStubBuffer2_Release NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree NdrStubCall2 NdrStubForwardingFunction

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsicmp calloc free fwrite getenv memcmp memcpy memmove strchr strcmp strcpy strcspn strlen wcslen wcstoul

kernel32

CloseHandle CreateFileMappingW DisableThreadLibraryCalls DuplicateHandle EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFree GlobalGetAtomNameW HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryW LoadResource MapViewOfFile MultiByteToWideChar OpenProcess RaiseException SizeofResource UnmapViewOfFile WideCharToMultiByte

ntdll

_vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

9ed2007523fd455fe5dcaccc7a8577df654e62e0dfc344e82921ce1513b71d5e

oleaut32

ole32

user32

rpcrt4

ucrtbase

kernel32

ntdll

generic