f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad

Sharing

Copy URL Twitter E-mail

General

Target
f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad
Size 1.8MB
Sample260930-r4lc3stte1
SHA256 f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad
MD5 0bb0555510493f15ee629854366216c7
SHA1 2cb346945cac8cc689b0e0788afe51ab1f843d1a
SHA512 c4e82c819805c4abb203a029444ee24d78a6d600eb6f4469c912b04ae902aed501b363e396f7d6fff8a69e6417ffaf7d67d0d3b82127096fdc7e4764fcdbb4d4
SSDEEP 24576:cnStrXhos1i7WhlNizrXAovUEcszbMDI:cnS7oJ7WhvizrXAovUEcszbMDI
TLSH
T1CF95B541B3E95889EA7783398AB76231373AB941173AEB4F2204D5391D33EC07EB6715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad

File Explorer

f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad

.dll 1.8MB

f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad

IMPHASH ffe13ba1da6c88b0ad7d70a13b34341f
SHA256 f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad
MD5 0bb0555510493f15ee629854366216c7
SHA1 2cb346945cac8cc689b0e0788afe51ab1f843d1a
SHA512 c4e82c819805c4abb203a029444ee24d78a6d600eb6f4469c912b04ae902aed501b363e396f7d6fff8a69e6417ffaf7d67d0d3b82127096fdc7e4764fcdbb4d4
SSDEEP 24576:cnStrXhos1i7WhlNizrXAovUEcszbMDI:cnS7oJ7WhvizrXAovUEcszbMDI
TLSH
T1CF95B541B3E95889EA7783398AB76231373AB941173AEB4F2204D5391D33EC07EB6715
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ChangeServiceConfig2W CloseServiceHandle ControlService ConvertSidToStringSidW CreateProcessAsUserW CreateServiceW DeleteService EnumDependentServicesW GetServiceDisplayNameW GetTokenInformation GetUserNameW LookupAccountNameW MD5Final MD5Init MD5Update OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyExW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW StartServiceW

cabinet

FDICreate FDICopy FDIDestroy

comctl32

ImageList_Add ImageList_Create ImageList_Destroy ImageList_ReplaceIcon

crypt32

CertDuplicateCertificateContext

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetObjectW GetStockObject GetTextMetricsW SelectObject SetBkMode SetTextColor StretchBlt

imagehlp

BindImage

kernel32

CloseHandle ConnectNamedPipe CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateNamedPipeW CreateProcessW CreateThread DebugBreak DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls DosDateTimeToFileTime DuplicateHandle EnterCriticalSection EnumResourceNamesW ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceExW FindResourceW FreeLibrary GetComputerNameW GetCurrentDirectoryW GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileSize GetFullPathNameW GetLocalTime GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameW GetModuleHandleW GetNativeSystemInfo GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDefaultLangID GetSystemDirectoryW GetSystemWow64DirectoryW GetTempFileNameW GetTempPathW GetTickCount GetTickCount64 GetTimeFormatW GetUserDefaultLangID GetVersion GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsValidCodePage IsValidLocale IsWow64Process IsWow64Process2 LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MoveFileExW MulDiv MultiByteToWideChar RaiseException ReadFile RemoveDirectoryW RtlUnwind SearchPathW SetFileAttributesW SetFilePointer SetFileTime SizeofResource Sleep SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile WritePrivateProfileStringW

mspatcha

ApplyPatchToFileW

ntdll

NtCreateSection NtQuerySection RtlGetVersion _vsnprintf

odbccp32

SQLConfigDataSourceW SQLRemoveTranslatorW SQLRemoveDriverW SQLInstallDriverExW SQLInstallTranslatorExW

ole32

CLSIDFromProgID CLSIDFromString CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize CreateILockBytesOnHGlobal CreateStreamOnHGlobal StgCreateDocfile StgOpenStorage StgOpenStorageOnILockBytes StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantInit VariantClear VariantCopy VariantCopyInd VariantChangeType DispGetParam SysAllocStringByteLen LoadTypeLib LoadRegTypeLib RegisterTypeLib LoadTypeLibEx SystemTimeToVariantTime VariantTimeToSystemTime UnRegisterTypeLib OleLoadPicture

rpcrt4

I_RpcExceptionFilter NdrClientCall2 NdrServerCall2 RpcBindingFree RpcBindingFromStringBindingW RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqEpW RpcStringBindingComposeW RpcStringFreeW

shell32

SHGetFolderPathW ShellExecuteW

shlwapi

PathAddBackslashW PathAppendW PathFindFileNameW PathIsRelativeW PathRemoveBackslashW PathRemoveFileSpecW PathStripPathW PathStripToRootW SHCreateStreamOnFileW StrFormatByteSizeW UrlIsW

sxs

CreateAssemblyCache

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsdup _wcsicmp _wcsnicmp _wcsupr _wtoi bsearch calloc free fwrite getenv iswdigit iswspace malloc memcmp memcpy memmove memset qsort realloc strcat strchr strcmp strcpy strcspn strlen strtol towupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr wcstol

urlmon

URLDownloadToCacheFileW

user32

AdjustWindowRect AppendMenuA CallWindowProcW CharLowerW CharUpperW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW EnableWindow EnumChildWindows GetClientRect GetDC GetFocus GetNextDlgTabItem GetParent GetPropW GetWindowLongPtrW GetWindowRect GetWindowTextW InvalidateRect IsDialogMessageW LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxExA MessageBoxExW MessageBoxW MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterClassW ReleaseDC RemovePropW SendMessageW SetFocus SetPropW SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage UnregisterClassW wsprintfA wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

GetUrlCacheEntryInfoW

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrustEx

DllCanUnloadNow DllGetClassObject DllGetVersion DllRegisterServer DllUnregisterServer Migrate10CachedPackagesA Migrate10CachedPackagesW MsiAdvertiseProductA MsiAdvertiseProductExA MsiAdvertiseProductExW MsiAdvertiseProductW MsiAdvertiseScriptA MsiAdvertiseScriptW MsiApplyMultiplePatchesA MsiApplyMultiplePatchesW MsiApplyPatchA MsiApplyPatchW MsiBeginTransactionA MsiBeginTransactionW MsiCloseAllHandles MsiCloseHandle MsiCollectUserInfoA MsiCollectUserInfoW MsiConfigureFeatureA MsiConfigureFeatureFromDescriptorA MsiConfigureFeatureFromDescriptorW MsiConfigureFeatureW MsiConfigureProductA MsiConfigureProductExA MsiConfigureProductExW MsiConfigureProductW MsiCreateAndVerifyInstallerDirectory MsiCreateRecord MsiCreateTransformSummaryInfoA MsiCreateTransformSummaryInfoW MsiDatabaseApplyTransformA MsiDatabaseApplyTransformW MsiDatabaseCommit MsiDatabaseExportA MsiDatabaseExportW MsiDatabaseGenerateTransformA MsiDatabaseGenerateTransformW MsiDatabaseGetPrimaryKeysA MsiDatabaseGetPrimaryKeysW MsiDatabaseImportA MsiDatabaseImportW MsiDatabaseIsTablePersistentA MsiDatabaseIsTablePersistentW MsiDatabaseMergeA MsiDatabaseMergeW MsiDatabaseOpenViewA MsiDatabaseOpenViewW MsiDecomposeDescriptorA MsiDecomposeDescriptorW MsiDeleteUserDataA MsiDeleteUserDataW MsiDetermineApplicablePatchesA MsiDetermineApplicablePatchesW MsiDeterminePatchSequenceA MsiDeterminePatchSequenceW MsiDoActionA MsiDoActionW MsiEnableLogA MsiEnableLogW MsiEnableUIPreview MsiEndTransaction MsiEnumClientsA MsiEnumClientsExA MsiEnumClientsExW MsiEnumClientsW MsiEnumComponentCostsA MsiEnumComponentCostsW MsiEnumComponentQualifiersA MsiEnumComponentQualifiersW MsiEnumComponentsA MsiEnumComponentsExA MsiEnumComponentsExW MsiEnumComponentsW MsiEnumFeaturesA MsiEnumFeaturesW MsiEnumPatchesA MsiEnumPatchesExA MsiEnumPatchesExW MsiEnumPatchesW MsiEnumProductsA MsiEnumProductsExA MsiEnumProductsExW MsiEnumProductsW MsiEnumRelatedProductsA MsiEnumRelatedProductsW MsiEvaluateConditionA MsiEvaluateConditionW MsiExtractPatchXMLDataA MsiExtractPatchXMLDataW MsiFormatRecordA MsiFormatRecordW MsiGetActiveDatabase MsiGetComponentPathA MsiGetComponentPathExA MsiGetComponentPathExW MsiGetComponentPathW MsiGetComponentStateA MsiGetComponentStateW MsiGetDatabaseState MsiGetFeatureCostA MsiGetFeatureCostW MsiGetFeatureInfoA MsiGetFeatureInfoW MsiGetFeatureStateA MsiGetFeatureStateW MsiGetFeatureUsageA MsiGetFeatureUsageW MsiGetFeatureValidStatesA MsiGetFeatureValidStatesW MsiGetFileHashA MsiGetFileHashW MsiGetFileSignatureInformationA MsiGetFileSignatureInformationW MsiGetFileVersionA MsiGetFileVersionW MsiGetLanguage MsiGetLastErrorRecord MsiGetMode MsiGetPatchFileListA MsiGetPatchFileListW MsiGetPatchInfoA MsiGetPatchInfoExA MsiGetPatchInfoExW MsiGetPatchInfoW MsiGetProductCodeA MsiGetProductCodeFromPackageCodeA MsiGetProductCodeFromPackageCodeW MsiGetProductCodeW MsiGetProductInfoA MsiGetProductInfoExA MsiGetProductInfoExW MsiGetProductInfoFromScriptA MsiGetProductInfoFromScriptW MsiGetProductInfoW MsiGetProductPropertyA MsiGetProductPropertyW MsiGetPropertyA MsiGetPropertyW MsiGetShortcutTargetA MsiGetShortcutTargetW MsiGetSourcePathA MsiGetSourcePathW MsiGetSummaryInformationA MsiGetSummaryInformationW MsiGetTargetPathA MsiGetTargetPathW MsiGetUserInfoA MsiGetUserInfoW MsiInstallMissingComponentA MsiInstallMissingComponentW MsiInstallMissingFileA MsiInstallMissingFileW MsiInstallProductA MsiInstallProductW MsiInvalidateFeatureCache MsiIsProductElevatedA MsiIsProductElevatedW MsiJoinTransaction MsiLoadStringA MsiLoadStringW MsiLocateComponentA MsiLocateComponentW MsiMessageBoxA MsiMessageBoxExA MsiMessageBoxExW MsiMessageBoxW MsiNotifySidChangeA MsiNotifySidChangeW MsiOpenDatabaseA MsiOpenDatabaseW MsiOpenPackageA MsiOpenPackageExA MsiOpenPackageExW MsiOpenPackageW MsiOpenProductA MsiOpenProductW MsiPreviewBillboardA MsiPreviewBillboardW MsiPreviewDialogA MsiPreviewDialogW MsiProcessAdvertiseScriptA MsiProcessAdvertiseScriptW MsiProcessMessage MsiProvideAssemblyA MsiProvideAssemblyW MsiProvideComponentA MsiProvideComponentFromDescriptorA MsiProvideComponentFromDescriptorW MsiProvideComponentW MsiProvideQualifiedComponentA MsiProvideQualifiedComponentExA MsiProvideQualifiedComponentExW MsiProvideQualifiedComponentW MsiQueryComponentStateA MsiQueryComponentStateW MsiQueryFeatureStateA MsiQueryFeatureStateExA MsiQueryFeatureStateExW MsiQueryFeatureStateFromDescriptorA MsiQueryFeatureStateFromDescriptorW MsiQueryFeatureStateW MsiQueryProductStateA MsiQueryProductStateW MsiRecordClearData MsiRecordDataSize MsiRecordGetFieldCount MsiRecordGetInteger MsiRecordGetStringA MsiRecordGetStringW MsiRecordIsNull MsiRecordReadStream MsiRecordSetInteger MsiRecordSetStreamA MsiRecordSetStreamW MsiRecordSetStringA MsiRecordSetStringW MsiReinstallFeatureA MsiReinstallFeatureFromDescriptorA MsiReinstallFeatureFromDescriptorW MsiReinstallFeatureW MsiReinstallProductA MsiReinstallProductW MsiRemovePatchesA MsiRemovePatchesW MsiSequenceA MsiSequenceW MsiSetComponentStateA MsiSetComponentStateW MsiSetExternalUIA MsiSetExternalUIRecord MsiSetExternalUIW MsiSetFeatureAttributesA MsiSetFeatureAttributesW MsiSetFeatureStateA MsiSetFeatureStateW MsiSetInstallLevel MsiSetInternalUI MsiSetMode MsiSetOfflineContextW MsiSetPropertyA MsiSetPropertyW MsiSetTargetPathA MsiSetTargetPathW MsiSourceListAddMediaDiskA MsiSourceListAddMediaDiskW MsiSourceListAddSourceA MsiSourceListAddSourceExA MsiSourceListAddSourceExW MsiSourceListAddSourceW MsiSourceListClearAllA MsiSourceListClearAllExA MsiSourceListClearAllExW MsiSourceListClearAllW MsiSourceListClearMediaDiskA MsiSourceListClearMediaDiskW MsiSourceListClearSourceA MsiSourceListClearSourceW MsiSourceListEnumMediaDisksA MsiSourceListEnumMediaDisksW MsiSourceListEnumSourcesA MsiSourceListEnumSourcesW MsiSourceListForceResolutionA MsiSourceListForceResolutionExA MsiSourceListForceResolutionExW MsiSourceListForceResolutionW MsiSourceListGetInfoA MsiSourceListGetInfoW MsiSourceListSetInfoA MsiSourceListSetInfoW MsiSummaryInfoGetPropertyA MsiSummaryInfoGetPropertyCount MsiSummaryInfoGetPropertyW MsiSummaryInfoPersist MsiSummaryInfoSetPropertyA MsiSummaryInfoSetPropertyW MsiUseFeatureA MsiUseFeatureExA MsiUseFeatureExW MsiUseFeatureW MsiVerifyDiskSpace MsiVerifyPackageA MsiVerifyPackageW MsiViewClose MsiViewExecute MsiViewFetch MsiViewGetColumnInfo MsiViewGetErrorA MsiViewGetErrorW MsiViewModify QueryInstanceCount __wine_msi_call_dll_function

Name

.text

Size

604KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

184KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/122483

Size

4KB

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

324KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f9df5e8d65741f1a4f43927a30c44808e1335e06908dd3be41ecd73a27a0d7ad

advapi32

cabinet

comctl32

crypt32

gdi32

imagehlp

kernel32

mspatcha

ntdll

odbccp32

ole32

oleaut32

rpcrt4

shell32

shlwapi

sxs

ucrtbase

urlmon

user32

version

wininet

wintrust

generic