b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024

Sharing

Copy URL Twitter E-mail

General

Target
b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024
Size 143KB
Sample260930-p3gbmaff65
SHA256 b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024
MD5 c38c0b3b698a37fb6a9fe2d200226d0c
SHA1 67315918f1dcfa4d931af5d90524877b0fa0f7bf
SHA512 65ba00f2e8d042fdbe727e883a746eaccabf10aba4a9bae1e70912a47f92be544b75c6810f6152560f032c51f6c9dbd4d57af76d9e34ea931a503153c1c3e06a
SSDEEP 3072:z9g25MVil6GYbQwJ6tuFm6fjGE8Kngu3ZbYLLkKgMvckVPxIiT2+ww/r:zR5M4ll26BEjGE8Knp3ZbuPO+B
TLSH
T1B1E35A00E987D07BE78F0431552B9B3A8F616585DBB396D7F7808DC788215D1BE3AB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024

File Explorer

b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024

.dll 143KB

b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024

IMPHASH 85b3085863ffad3aad7fcc88c5624455
SHA256 b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024
MD5 c38c0b3b698a37fb6a9fe2d200226d0c
SHA1 67315918f1dcfa4d931af5d90524877b0fa0f7bf
SHA512 65ba00f2e8d042fdbe727e883a746eaccabf10aba4a9bae1e70912a47f92be544b75c6810f6152560f032c51f6c9dbd4d57af76d9e34ea931a503153c1c3e06a
SSDEEP 3072:z9g25MVil6GYbQwJ6tuFm6fjGE8Kngu3ZbYLLkKgMvckVPxIiT2+ww/r:zR5M4ll26BEjGE8Knp3ZbuPO+B
TLSH
T1B1E35A00E987D07BE78F0431552B9B3A8F616585DBB396D7F7808DC788215D1BE3AB0A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW LogonUserW RegOpenKeyExW RegQueryValueExW

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileMappingW CreateProcessW CreateToolhelp32Snapshot DisableThreadLibraryCalls ExitProcess ExpandEnvironmentStringsW FindResourceW FlushInstructionCache FreeLibrary GetCommandLineW GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileSectionW GetPrivateProfileStringW GetProcAddress GetSystemDirectoryW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadContext GetTickCount64 GetVolumeInformationW InitializeSListHead InterlockedFlushSList IsProcessorFeaturePresent K32GetModuleInformation LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MulDiv OpenFileMappingW Process32FirstW Process32NextW QueryPerformanceCounter ReleaseSRWLockExclusive ResumeThread SetEnvironmentVariableW SetLastError SetThreadContext SizeofResource Sleep SleepConditionVariableSRW SuspendThread TerminateProcess TryAcquireSRWLockExclusive UnmapViewOfFile UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WakeAllConditionVariable lstrcatW lstrcmpiW lstrcpyW

crypt32

CryptProtectData CryptUnprotectData

samcli

NetUserGetInfo

user32

CallNextHookEx ClientToScreen DispatchMessageW EnumChildWindows EnumWindows GetAncestor GetAsyncKeyState GetCapture GetClassNameW GetClientRect GetCursorPos GetFocus GetForegroundWindow GetKeyState GetMessageW GetMonitorInfoW GetParent GetSystemMetrics GetWindowRect GetWindowThreadProcessId IsRectEmpty IsWindowVisible KillTimer MonitorFromWindow PostMessageW PtInRect RegisterHotKey SendInput SetActiveWindow SetCursorPos SetForegroundWindow SetTimer SetWindowPos SetWindowsHookExW ShowWindow TranslateMessage VkKeyScanW WindowFromPoint keybd_event

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize PropVariantClear

shell32

CommandLineToArgvW SHGetPropertyStoreForWindow SetCurrentProcessExplicitAppUserModelID

shlwapi

ord437 PathCanonicalizeW PathRemoveFileSpecW StrStrIW

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantClear VariantInit

msvcrt

?terminate@@YAXXZ _CxxThrowException __CppXcptFilter __CxxFrameHandler3 __getmainargs _amsg_exit _beginthreadex _callnewh _errno _except_handler4_common _initterm _initterm_e _msize _wcsicmp _wsystem ceil free isspace iswalnum iswdigit malloc memcpy memmove memset realloc strcpy_s strlen towlower towupper wcslen wcsrchr wcsstr wcstoul

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

14B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b5d977d830188d270e5d37ef44c8929d4db01f1b1f14fe00e0e56a9eaa412024

advapi32

kernel32

crypt32

samcli

user32

ole32

shell32

shlwapi

oleaut32

msvcrt

generic