9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f

Sharing

Copy URL Twitter E-mail

General

Target
9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f
Size 1.0MB
Sample260930-pwsq3sydph
SHA256 9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f
MD5 a4b7796ca874c2499e4c4547d86308de
SHA1 a507dfbab136a35bd21c3361ec90f522652d2044
SHA512 012f85464d44b27ec6db7243a8fcaa9a37501a01b1e2af773c11a7dcae641619ef551b316f8683cf0e7b4d5f2b4db2fad5b45a1fe58f19ab6f224330ac0bd423
SSDEEP 6144:ZyK4/BXbdhO44CIoLbKNQ6EdMLBukkPP789mS:Zn43hZIoL6gkk3u
TLSH
T1A8356221E3ED8A06F6F3AB3C6DB952511E36BDA5AE34CA4F0601265D08F0E94DD74723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f

File Explorer

9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f

.dll 1.0MB

9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f

IMPHASH 2f1152304935bf75a3c21dcd1e92ec99
SHA256 9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f
MD5 a4b7796ca874c2499e4c4547d86308de
SHA1 a507dfbab136a35bd21c3361ec90f522652d2044
SHA512 012f85464d44b27ec6db7243a8fcaa9a37501a01b1e2af773c11a7dcae641619ef551b316f8683cf0e7b4d5f2b4db2fad5b45a1fe58f19ab6f224330ac0bd423
SSDEEP 6144:ZyK4/BXbdhO44CIoLbKNQ6EdMLBukkPP789mS:Zn43hZIoL6gkk3u
TLSH
T1A8356221E3ED8A06F6F3AB3C6DB952511E36BDA5AE34CA4F0601265D08F0E94DD74723
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

crypt32

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddStoreToCollection CertCloseStore CertCreateCertificateChainEngine CertDeleteCertificateFromStore CertDuplicateCertificateContext CertEnumCRLsInStore CertEnumCTLsInStore CertEnumCertificatesInStore CertEnumSystemStore CertFindExtension CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetValidUsages CertNameToStrW CertOpenStore CertOpenSystemStoreW CertRDNValueToStrW CertSaveStore CertSetCertificateContextProperty CertSetEnhancedKeyUsage CryptBinaryToStringA CryptDecodeObjectEx CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptQueryObject PFXExportCertStore

ole32

CreateBindCtx OleCreateDefaultHandler

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_SetBkColor PropertySheetW

comdlg32

GetOpenFileNameW GetSaveFileNameW

user32

DialogBoxParamW EnableWindow EndDialog EnumChildWindows GetClassLongW GetDC GetDlgItem GetParent GetWindowLongPtrW GetWindowRect IsDlgButtonChecked LoadBitmapW LoadImageW LoadStringW MapWindowPoints MessageBoxW PostMessageW ReleaseDC SendMessageA SendMessageW SetFocus SetWindowLongPtrW SetWindowPos ShowScrollBar ShowWindow

gdi32

CreateFontW DeleteObject GetDeviceCaps

advapi32

CryptAcquireContextW CryptDestroyKey CryptGetKeyParam CryptGetUserKey CryptReleaseContext CryptSetProvParam RegCloseKey RegCreateKeyExW RegDeleteValueA RegQueryValueExA RegSetValueExA

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp calloc free fwrite getenv iswprint iswspace malloc memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen wcslen wcsrchr

kernel32

CloseHandle CompareFileTime CreateFileW DelayLoadFailureHook DisableThreadLibraryCalls EnumResourceNamesW FileTimeToSystemTime FindResourceW FormatMessageW FreeLibrary GetDateFormatW GetEnvironmentVariableW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource LocalFree MulDiv MultiByteToWideChar RaiseException ResolveDelayLoadedAPI SizeofResource WriteFile lstrcmpW

ntdll

_vsnprintf

Name

.text

Size

72KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

888KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9110c06099e2e3cede7e52ca8770512933738bea9b470672da5cff76cf0ff57f

crypt32

ole32

comctl32

comdlg32

user32

gdi32

advapi32

ucrtbase

kernel32

ntdll

generic