83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4

Sharing

Copy URL Twitter E-mail

General

Target
83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4
Size 296KB
Sample260930-r2tlnstsbx
SHA256 83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4
MD5 8e9c0ce3acbc866eed8c6657681447f7
SHA1 41b15c2e9da8ea2f8b776c76c92f476c51787752
SHA512 984d472193a85ebd2319a4670158e857d52a8a1a5feaa37b0fc62f65c787ef0e681f8c50c5888bfb147e92af7e81e5fd2f65e275f32e58663320c7d0e3fd96dd
SSDEEP 3072:cv1y+UFvxdMLma/wrwHijz98r1u8GBBJOgNECGHHNp1OI/qytuQQILw8YQdZUxSX:o1j+Jd64jG1u8RiFytu4wqZU
TLSH
T16354D9C2B3A94499D676833989F753317739FAC103719BCB6608E2312D23AE47EB9705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4

File Explorer

83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4

.dll 296KB

83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4

IMPHASH 9fe9aa551394764e23366b3c91d68e1c
SHA256 83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4
MD5 8e9c0ce3acbc866eed8c6657681447f7
SHA1 41b15c2e9da8ea2f8b776c76c92f476c51787752
SHA512 984d472193a85ebd2319a4670158e857d52a8a1a5feaa37b0fc62f65c787ef0e681f8c50c5888bfb147e92af7e81e5fd2f65e275f32e58663320c7d0e3fd96dd
SSDEEP 3072:cv1y+UFvxdMLma/wrwHijz98r1u8GBBJOgNECGHHNp1OI/qytuQQILw8YQdZUxSX:o1j+Jd64jG1u8RiFytu4wqZU
TLSH
T16354D9C2B3A94499D676833989F753317739FAC103719BCB6608E2312D23AE47EB9705
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyA RegCreateKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyA RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyA RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegQueryValueW RegSetValueExA RegSetValueExW

compstui

CommonPropertySheetUIW

gdi32

GdiConvertToDevmodeW

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateMutexW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FindResourceW FreeLibrary GetComputerNameW GetFileAttributesW GetFullPathNameW GetModuleHandleW GetProcAddress GetProfileStringW GetTempPathW GetTickCount GetVersion HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource MultiByteToWideChar RaiseException ReleaseMutex RemoveDirectoryW SizeofResource WaitForSingleObject WideCharToMultiByte WriteFile

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlCreateUnicodeStringFromAsciiz RtlDosPathNameToNtPathName_U RtlFindExportedRoutineByName RtlFreeUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp calloc free fwrite getenv malloc memchr memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcspbrk

user32

DialogBoxParamW EndDialog GetDlgItemTextW GetForegroundWindow GetWindowLongPtrW LoadStringW MessageBoxW SendDlgItemMessageW SetWindowLongPtrW

ADVANCEDSETUPDIALOG AbortPrinter AddFormA AddFormW AddJobA AddJobW AddMonitorA AddMonitorW AddPortA AddPortExA AddPortExW AddPortW AddPrintProcessorA AddPrintProcessorW AddPrintProvidorA AddPrintProvidorW AddPrinterA AddPrinterConnectionA AddPrinterConnectionW AddPrinterDriverA AddPrinterDriverExA AddPrinterDriverExW AddPrinterDriverW AddPrinterW AdvancedDocumentPropertiesA AdvancedDocumentPropertiesW AdvancedSetupDialog ClosePrinter ConfigurePortA ConfigurePortW ConnectToPrinterDlg ConvertAnsiDevModeToUnicodeDevMode ConvertUnicodeDevModeToAnsiDevMode CreatePrinterIC DEVICECAPABILITIES DEVICEMODE DeleteFormA DeleteFormW DeleteMonitorA DeleteMonitorW DeletePortA DeletePortW DeletePrintProcessorA DeletePrintProcessorW DeletePrintProvidorA DeletePrintProvidorW DeletePrinter DeletePrinterConnectionA DeletePrinterConnectionW DeletePrinterDataExA DeletePrinterDataExW DeletePrinterDriverA DeletePrinterDriverExA DeletePrinterDriverExW DeletePrinterDriverW DeletePrinterIC DevQueryPrint DeviceCapabilities DeviceCapabilitiesA DeviceCapabilitiesW DeviceMode DocumentEvent DocumentPropertiesA DocumentPropertiesW EXTDEVICEMODE EndDocPrinter EndPagePrinter EnumFormsA EnumFormsW EnumJobsA EnumJobsW EnumMonitorsA EnumMonitorsW EnumPortsA EnumPortsW EnumPrintProcessorDatatypesA EnumPrintProcessorDatatypesW EnumPrintProcessorsA EnumPrintProcessorsW EnumPrinterDataA EnumPrinterDataExA EnumPrinterDataExW EnumPrinterDataW EnumPrinterDriversA EnumPrinterDriversW EnumPrinterKeyA EnumPrinterKeyW EnumPrintersA EnumPrintersW ExtDeviceMode FindClosePrinterChangeNotification FindFirstPrinterChangeNotification FindNextPrinterChangeNotification FreePrinterNotifyInfo GetDefaultPrinterA GetDefaultPrinterW GetFormA GetFormW GetJobA GetJobW GetPrintProcessorDirectoryA GetPrintProcessorDirectoryW GetPrinterA GetPrinterDataA GetPrinterDataExA GetPrinterDataExW GetPrinterDataW GetPrinterDriverA GetPrinterDriverDirectoryA GetPrinterDriverDirectoryW GetPrinterDriverW GetPrinterW GetSpoolFileHandle IsValidDevmodeA IsValidDevmodeW OpenPrinter2A OpenPrinter2W OpenPrinterA OpenPrinterW PerfClose PerfCollect PerfOpen PlayGdiScriptOnPrinterIC PrinterMessageBoxA PrinterMessageBoxW PrinterProperties ReadPrinter ResetPrinterA ResetPrinterW ScheduleJob SeekPrinter SetAllocFailCount SetDefaultPrinterA SetDefaultPrinterW SetFormA SetFormW SetJobA SetJobW SetPrinterA SetPrinterDataA SetPrinterDataExA SetPrinterDataExW SetPrinterDataW SetPrinterW SpoolerDevQueryPrintW SpoolerInit SpoolerPrinterEvent StartDocDlgA StartDocDlgW StartDocPrinterA StartDocPrinterW StartPagePrinter UploadPrinterDriverPackageA UploadPrinterDriverPackageW WaitForPrinterChange WritePrinter XcvDataW

Name

.text

Size

100KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

16KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/6047

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

83279babcd07c9a84134d8fcc8c0014de83a34a9e67bde2c955aae57ea5eb4d4

advapi32

compstui

gdi32

kernel32

ntdll

ucrtbase

user32

generic