3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc

Sharing

Copy URL Twitter E-mail

General

Target
3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc
Size 12.3MB
Sample260930-kf1pjasfpg
SHA256 3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc
MD5 78e9f77f442575408d7227f4bad51a00
SHA1 a6a923e82a911ab2cd5f11d19093406a2678aafe
SHA512 c40878bc3659832e7b2aadd9a6b3fcaa7942693a6f9f44ab42c0533939fd3fc795f325cb86b2aa8d5c61057b065eed151b697ae826ee8cc96b7b19fafb7aaa7e
SSDEEP 196608:C1YK/XkarAIR/WzyUzldGgLZsF+Iejgv3wSH9xTsDMOyoKfNkp8HLNemRJXzfJ4d:CuWkIE1Ox+iHfsQOJ2HLNeqz4
TLSH
T188D67C327751D53BC6035873552D96BF0168BB708BB588CBEB481A2C6BB46D2E235F23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc

File Explorer

3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc

.exe 12.3MB

3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc

IMPHASH 0719a2bf559c0d554f351210b2fce3ee
SHA256 3e6107b5d851e5172d0ad54a30419d7fa9d69ecd54b7890cb0a9241e2a59a3fc
MD5 78e9f77f442575408d7227f4bad51a00
SHA1 a6a923e82a911ab2cd5f11d19093406a2678aafe
SHA512 c40878bc3659832e7b2aadd9a6b3fcaa7942693a6f9f44ab42c0533939fd3fc795f325cb86b2aa8d5c61057b065eed151b697ae826ee8cc96b7b19fafb7aaa7e
SSDEEP 196608:C1YK/XkarAIR/WzyUzldGgLZsF+Iejgv3wSH9xTsDMOyoKfNkp8HLNemRJXzfJ4d:CuWkIE1Ox+iHfsQOJ2HLNeqz4
TLSH
T188D67C327751D53BC6035873552D96BF0168BB708BB588CBEB481A2C6BB46D2E235F23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6892953

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\TinyDL_Build\build\Release\TinyDL.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueA

psapi

GetModuleFileNameExW GetMappedFileNameW GetProcessImageFileNameW

ws2_32

accept freeaddrinfo getaddrinfo WSAIoctl recvfrom ntohs htons getsockopt getsockname getpeername connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket WSAGetLastError WSACleanup WSAStartup gethostbyname inet_ntoa inet_addr ntohl htonl listen sendto ioctlsocket getnameinfo gethostname shutdown setsockopt

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CryptDecodeObject CryptMsgOpenToDecode CryptMsgClose CryptMsgUpdate CryptMsgGetParam CertOpenStore CertGetCertificateContextProperty CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringA CertGetNameStringW CryptQueryObject

wldap32

ord27 ord26 ord22 ord41 ord33 ord60 ord211 ord46 ord217 ord143 ord32 ord35 ord79 ord30 ord200 ord50 ord301

kernel32

GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCurrentProcess TerminateProcess GetLastError CloseHandle GetTickCount CreateMutexW OpenMutexW GetModuleFileNameW GetCommandLineW MultiByteToWideChar WideCharToMultiByte FreeLibrary GetProcAddress LoadLibraryW GetCommandLineA GetSystemInfo TerminateThread WaitForSingleObject Sleep WriteFile ReadFile ConnectNamedPipe CreateFileW CreateNamedPipeW CancelSynchronousIo CreateProcessW GetFileInformationByHandle DeviceIoControl SetEndOfFile SetFilePointerEx FindClose GetFileTime SetFileTime SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW CreateDirectoryW CreateDirectoryExW RemoveDirectoryW SetFileAttributesW GetFileAttributesW GetFileAttributesExW DeleteFileW FindFirstFileW FindNextFileW CopyFileW MoveFileExW DecodePointer HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ReleaseMutex CreateMutexA CreateEventA OpenEventA QueryPerformanceCounter QueryPerformanceFrequency SetLastError GetLongPathNameW EnterCriticalSection LeaveCriticalSection ReleaseSemaphore FlushFileBuffers GetSystemTime SystemTimeToFileTime MapViewOfFile UnmapViewOfFile CreateSemaphoreW CreateFileMappingW OutputDebugStringA OutputDebugStringW GetFullPathNameW GetFileSize GetFileSizeEx GetModuleFileNameA GetModuleHandleA GetModuleHandleW RegisterWaitForSingleObject InterlockedDecrement GlobalMemoryStatusEx LocalAlloc LocalFree VirtualAlloc VirtualFree OpenProcess GetSystemTimes FileTimeToLocalFileTime FileTimeToSystemTime CreatePipe lstrcmpA lstrcpyW GetLogicalDriveStringsA CreateProcessA GetStartupInfoA ExpandEnvironmentStringsA WritePrivateProfileStringW GetDriveTypeA GetDriveTypeW GetVersionExA GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next Module32FirstW CreateThread SetFilePointer CreateWaitableTimerA SetWaitableTimer GetCurrentProcessId lstrcpynA GetCurrentThread SetThreadAffinityMask GetCurrentThreadId ResetEvent WaitForSingleObjectEx CreateFileA LoadLibraryA GetSystemDirectoryA InterlockedExchange InterlockedCompareExchange SwitchToThread GetPrivateProfileIntA GetPrivateProfileStringA CreateDirectoryA DeleteFileA FindFirstFileA CopyFileA GetExitCodeThread VirtualQueryEx CreateRemoteThread GetLogicalDrives DuplicateHandle GetNativeSystemInfo CreateFileMappingA GetWindowsDirectoryW GetSystemWow64DirectoryW QueryDosDeviceW CopyFileExW GetVolumeInformationW GetVolumeNameForVolumeMountPointW GetVolumePathNameW IsWow64Process Module32NextW FormatMessageA GetSystemTimeAsFileTime LockFileEx UnlockFile HeapCompact FlushViewOfFile RtlCaptureStackBackTrace GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection VirtualLock VirtualUnlock CreateSemaphoreA InterlockedExchangeAdd SleepEx GetStdHandle GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW PeekNamedPipe WaitForMultipleObjects VerSetConditionMask VerifyVersionInfoA SwitchToFiber DeleteFiber CreateFiber GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ConvertFiberToThread ConvertThreadToFiber GetCPInfo EncodePointer CreateEventW CreateHardLinkW FindFirstFileExW GetStringTypeW GetThreadTimes UnregisterWait FreeLibraryAndExitThread LoadLibraryExW VirtualProtect SetProcessAffinityMask InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx WaitForMultipleObjectsEx RtlUnwind ExitThread ResumeThread SystemTimeToTzSpecificLocalTime ExitProcess SetConsoleCtrlHandler SetEnvironmentVariableA SetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA GetACP GetConsoleCP GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation SetStdHandle FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW HeapQueryInformation WriteConsoleW GlobalFree GetPrivateProfileStringW GetFileAttributesA

user32

LoadStringW GetParent SetWindowLongW GetWindowLongW MessageBoxW GetSystemMetrics SetDlgItemTextW EnumDisplayDevicesA SetWindowPos CallWindowProcW SendMessageW SetWindowLongA GetWindowLongA UpdateWindow ShowWindow DestroyWindow MsgWaitForMultipleObjects CharLowerBuffA PostMessageA GetUserObjectInformationW RegisterClassExW CreateWindowExW EndDialog GetProcessWindowStation CreateWindowExA DefWindowProcA PeekMessageA GetWindowRect DispatchMessageW UnregisterClassW UnregisterClassA PeekMessageW TranslateMessage

shell32

SHGetSpecialFolderPathA ShellExecuteW SHGetDesktopFolder SHBrowseForFolderW SHGetFolderPathW SHGetSpecialFolderPathW SHGetPathFromIDListW SHCreateDirectoryExW ShellExecuteExW SHFileOperationW SHGetFolderPathA

ole32

CoInitializeEx CoUninitialize CoInitialize CoTaskMemFree CoSetProxyBlanket CoCreateInstance CoCreateGuid CoInitializeSecurity StringFromCLSID IIDFromString

oleaut32

GetErrorInfo VariantInit VariantChangeType CreateErrorInfo SetErrorInfo SysFreeString SysAllocString VariantClear VarBstrCmp

comdlg32

GetOpenFileNameW

advapi32

BuildExplicitAccessWithNameW InitializeSecurityDescriptor SetSecurityDescriptorDacl CryptAcquireContextW CryptGenRandom CryptReleaseContext OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA GetUserNameW RegCloseKey RegEnumValueA RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW CryptAcquireContextA RegCreateKeyW RegOpenKeyW RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW DeregisterEventSource RegisterEventSourceW ReportEventW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW

shlwapi

PathIsDirectoryW PathAppendA PathStripPathW PathRemoveFileSpecW PathFileExistsW StrCmpW PathIsDirectoryEmptyW

iphlpapi

GetAdaptersInfo

netapi32

NetApiBufferFree Netbios NetWkstaTransportEnum

winhttp

WinHttpCloseHandle WinHttpGetProxyForUrl WinHttpCrackUrl WinHttpOpen WinHttpGetIEProxyConfigForCurrentUser

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

104KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QMGuid

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=22, id=241, version=40116,

count=209, id=243, version=40116,

count=32, id=242, version=40116,

count=1, id=261, productName=VS2017 v15.8.9? build 26730, version=26730,

count=7, id=199, version=41118,

count=27, id=259, version=26706,

count=137, id=261, version=26706,

count=38, id=260, version=26706,

count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=671, id=260, productName=VS2017 v15.9.4 build 27025, version=27025,

count=28, id=261, version=27024,

count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=454, id=1, productName=Unmarked objects,

count=4, id=265, version=27043,

count=17, id=260, version=27043,

count=89, id=261, version=27043,

count=1, id=255, version=27043,

count=1, id=151,

count=1, id=258, version=27043,