646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf

Sharing

Copy URL Twitter E-mail

General

Target
646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf
Size 2.5MB
Sample260930-qywfesseke
SHA256 646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf
MD5 0ad4474c47eba37015957e0bcde047da
SHA1 a979ed2aceebad6aaf37b4c4e5ba5a045adf8b41
SHA512 66fbe64f7b87e6da8606390483f692f8187789caa69164afd0a96e1d46f2c6715f6d57a49d8e1b9496b7a7ae27ee63a994fe97b7aa6e37803afeabd5b4ce4d80
SSDEEP 49152:TnDylOlDIJcXEGWJCVMuP3N7J5BSKSe2vnMRmkNplWckS2vf:LeElDIJc0CV57Bb+nMUkTl9/4f
TLSH
T1B3C5F122F2D640F2C6E54431443BBF76B679A72A4A01CDB39394ED8D2D239E1D623277
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf

File Explorer

646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf

.exe 2.5MB

646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf

IMPHASH a8255ed49fa32f47bd4e685e04923ac7
SHA256 646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf
MD5 0ad4474c47eba37015957e0bcde047da
SHA1 a979ed2aceebad6aaf37b4c4e5ba5a045adf8b41
SHA512 66fbe64f7b87e6da8606390483f692f8187789caa69164afd0a96e1d46f2c6715f6d57a49d8e1b9496b7a7ae27ee63a994fe97b7aa6e37803afeabd5b4ce4d80
SSDEEP 49152:TnDylOlDIJcXEGWJCVMuP3N7J5BSKSe2vnMRmkNplWckS2vf:LeElDIJc0CV57Bb+nMUkTl9/4f
TLSH
T1B3C5F122F2D640F2C6E54431443BBF76B679A72A4A01CDB39394ED8D2D239E1D623277
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

439395

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetACP HeapSize TerminateProcess GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind GetStartupInfoA GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetEnvironmentStrings GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpiA SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer DuplicateHandle lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement InterlockedIncrement GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle WideCharToMultiByte MultiByteToWideChar GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile ReadFile GetLastError WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource GetModuleFileNameA GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA WinExec lstrcpyA FindNextFileA CloseHandle GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetFullPathNameA FreeLibrary LoadLibraryA lstrlenA GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject GetCurrentThread

user32

GetForegroundWindow SystemParametersInfoA LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetSystemMenu DeleteMenu GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture GetScrollRange SetScrollRange SetScrollPos InflateRect SetRect IntersectRect DestroyIcon UnregisterClassA OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow LoadStringA GetSysColorBrush GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA PtInRect

gdi32

GetTextMetricsA LineTo Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn SetBkColor CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject GetObjectA CreatePen PatBlt FillRgn CreateRectRgn CombineRgn CreateSolidBrush GetStockObject MoveToEx ExcludeClipRect GetClipBox ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetTextColor SetROP2 SetPolyFillMode SetBkMode RestoreDC SaveDC CreateFontIndirectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps

winmm

midiOutReset midiStreamRestart midiStreamStop midiStreamOut waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutPause midiOutPrepareHeader midiStreamProperty waveOutReset waveOutClose waveOutGetNumDevs waveOutOpen midiOutUnprepareHeader midiStreamOpen midiStreamClose

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA RegQueryValueA

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA

ole32

OleUninitialize OleInitialize CLSIDFromString

oleaut32

UnRegisterTypeLi RegisterTypeLi LoadTypeLi

comctl32

ImageList_Destroy ord17

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ioctlsocket recv getpeername accept

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA

Sharing

General

Malware Config

Signatures

File Explorer

646a486c604fdc14d3e8360db5dfe40160578d5b585eaf23c16ebf00d895abbf

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

generic