dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

Sharing

Copy URL Twitter E-mail

General

Target
dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f
Size 6.7MB
Sample260930-kla13ataka
SHA256 dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f
MD5 317c1ce217ae98b230a789544b786a3b
SHA1 2a674173b20d74dab79310cfcc83e64f05a1a545
SHA512 d15d8479a4fe8c94b3e4d10ae178905ddac5f1ab344c2d958fbede946641eaeadf72a175be6ac2334600a6df7abe1cc0ff2462bf37ba2e1e9da4d61380416312
SSDEEP 98304:3pULdlyjls7bf66D6n2kvW6HBfEqAqlDc54oNbmHsZm/VK3JTnfJ4k:3CLdlo27bfhaBfEqFx4mCJTfJ4
TLSH
T13D66C002F7529179EC9350B6697DA72D242D6D316B5108C7C2C47EA96FF4AC02E323AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

File Explorer

dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

.exe 6.7MB

dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

IMPHASH 058b62fd79e1f72a2f7fc2a7e3161218
SHA256 dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f
MD5 317c1ce217ae98b230a789544b786a3b
SHA1 2a674173b20d74dab79310cfcc83e64f05a1a545
SHA512 d15d8479a4fe8c94b3e4d10ae178905ddac5f1ab344c2d958fbede946641eaeadf72a175be6ac2334600a6df7abe1cc0ff2462bf37ba2e1e9da4d61380416312
SSDEEP 98304:3pULdlyjls7bf66D6n2kvW6HBfEqAqlDc54oNbmHsZm/VK3JTnfJ4k:3CLdlo27bfhaBfEqFx4mCJTfJ4
TLSH
T13D66C002F7529179EC9350B6697DA72D242D6D316B5108C7C2C47EA96FF4AC02E323AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2596016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

G:\se15\src\out\Release\setup.exe.pdb

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSidToSidW CreateProcessAsUserW DuplicateTokenEx FreeSid GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetTokenInformation GetUserNameW ImpersonateLoggedOnUser IsValidAcl IsValidSecurityDescriptor IsValidSid LookupAccountNameW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExA RegCreateKeyExW RegDeleteKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegLoadKeyW RegOpenCurrentUser RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW RegUnLoadKeyW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityInfo SystemFunction036

comdlg32

GetOpenFileNameW

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgn CreateRectRgnIndirect DeleteDC DeleteObject GdiAlphaBlend GetCurrentObject GetDIBits GetDeviceCaps GetLayout GetObjectType GetObjectW GetRandomRgn GetRgnBox GetStockObject GetTextExtentPoint32W IntersectClipRect LPtoDP ModifyWorldTransform OffsetRgn RectVisible RestoreDC SaveDC SelectClipRgn SelectObject SetBkMode SetDIBColorTable SetGraphicsMode SetLayout SetViewportOrgEx SetWindowOrgEx SetWorldTransform StretchBlt

oleaut32

CreateDispTypeInfo CreateStdDispatch SysAllocString SysAllocStringLen SysFreeString SysStringLen VarCmp VarUI4FromStr VariantChangeType VariantClear VariantCopy VariantInit

shlwapi

PathAppendW PathCombineW PathFileExistsW PathFindExtensionW PathFindFileNameA PathFindFileNameW PathGetDriveNumberW PathIsDirectoryW PathMatchSpecW PathRemoveFileSpecW SHDeleteKeyW SHDeleteValueW SHGetValueA SHGetValueW SHSetValueW StrCpyW StrStrIW

user32

AdjustWindowRectEx AllowSetForegroundWindow AttachThreadInput BeginPaint BringWindowToTop CallWindowProcW CharNextW CharUpperW CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawIconEx DrawTextW EndPaint FillRect FindWindowExW FindWindowW GetActiveWindow GetAsyncKeyState GetCapture GetClassInfoExW GetClassNameW GetClientRect GetCursorPos GetDC GetDesktopWindow GetFocus GetForegroundWindow GetIconInfo GetKeyState GetMessageExtraInfo GetMessagePos GetMessageW GetMonitorInfoW GetParent GetShellWindow GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextW GetWindowThreadProcessId InflateRect IntersectRect InvalidateRect InvalidateRgn IsIconic IsWindow IsWindowVisible KillTimer LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxW MonitorFromWindow MoveWindow PostMessageW PostQuitMessage PtInRect RegisterClassExW RegisterClassW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetActiveWindow SetCapture SetCursor SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW TrackMouseEvent TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateLayeredWindow UpdateWindow WindowFromDC wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CancelWaitableTimer CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateJobObjectW CreateMutexW CreateProcessW CreateRemoteThread CreateSemaphoreW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerW DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl EncodePointer EnterCriticalSection EnumResourceNamesW EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceExW FindResourceW FlushFileBuffers FlushInstructionCache FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalDriveStringsW GetLongPathNameA GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempFileNameW GetTempPathW GetThreadContext GetThreadId GetThreadPreferredUILanguages GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapDestroy HeapFree HeapLock HeapReAlloc HeapSize HeapUnlock HeapWalk InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedDecrement InterlockedIncrement InterlockedPopEntrySList InterlockedPushEntrySList IsBadReadPtr IsBadWritePtr IsDebuggerPresent IsProcessInJob IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcesses K32GetModuleFileNameExW K32GetModuleInformation K32GetProcessImageFileNameW K32GetProcessMemoryInfo K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenMutexW OpenProcess OpenThread OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ReplaceFileW ResetEvent ResumeThread RtlCaptureStackBackTrace RtlUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SizeofResource Sleep SleepConditionVariableSRW SuspendThread SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WritePrivateProfileStringW lstrcmpA lstrcmpiA lstrcmpiW lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoInitialize CoInitializeEx CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize DoDragDrop OleInitialize OleUninitialize PropVariantClear RegisterDragDrop RevokeDragDrop

rpcrt4

NdrClientCall2 RpcBindingFromStringBindingW RpcStringBindingComposeW

comctl32

InitCommonControlsEx

gdiplus

GdipAlloc GdipBitmapLockBits GdipBitmapUnlockBits GdipCloneImage GdipCreateBitmapFromFile GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateFromHDC GdipCreateImageAttributes GdipDeleteGraphics GdipDisposeImage GdipDisposeImageAttributes GdipDrawImageI GdipDrawImagePointRectI GdipDrawImageRectRectI GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipGetImageHeight GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageWidth GdipSaveImageToFile GdipSetImageAttributesColorMatrix GdipSetImageAttributesWrapMode GdipSetInterpolationMode GdipSetSmoothingMode GdiplusShutdown GdiplusStartup

secur32

GetUserNameExW

propsys

InitPropVariantFromCLSID

ntdll

NtDeleteKey

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

netapi32

Netbios

Name

.text

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

900KB

Virtual Size

899KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

258B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

875KB

Virtual Size

875KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

dd63ab2324c9dafd922f92332280476e03e28c4e56df719fb7a529bf8183ee3f

advapi32

comdlg32

gdi32

oleaut32

shlwapi

user32

version

winmm

kernel32

ole32

rpcrt4

comctl32

gdiplus

secur32

propsys

ntdll

userenv

netapi32

generic