2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e

Sharing

Copy URL Twitter E-mail

General

Target
2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e
Size 4.4MB
Sample260930-s45bmaydle
SHA256 2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e
MD5 dac8c17717440498d648ba412eeab448
SHA1 0de8b93542b962538ccfc425b1187dd418cdea21
SHA512 e4d23e2ffac037cb208a1e7ccb8862e60a90269000dd456e13079d761568f172d47e9d8a4c0d76ce001d49e97b277245bf437bd02ff22ec67a95dc37554efbed
SSDEEP 49152:ojGxynOKdDKPEG/MuMhM/McR8gaMsZ4IKBoZ3WNQURVuCvxlKXqEmtZG1nzNoon0:8PnOUaPMG/MchsZ4PlTFEmIKih4
TLSH
T18C263A5AA6B640E8D47AC038C583A12FF9B278A647305BCB56914F5B2F33BE45D3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e

File Explorer

2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e

.exe 4.4MB

2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e

IMPHASH 6a50e47a4e885acaf41ffb5a6990bb42
SHA256 2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e
MD5 dac8c17717440498d648ba412eeab448
SHA1 0de8b93542b962538ccfc425b1187dd418cdea21
SHA512 e4d23e2ffac037cb208a1e7ccb8862e60a90269000dd456e13079d761568f172d47e9d8a4c0d76ce001d49e97b277245bf437bd02ff22ec67a95dc37554efbed
SSDEEP 49152:ojGxynOKdDKPEG/MuMhM/McR8gaMsZ4IKBoZ3WNQURVuCvxlKXqEmtZG1nzNoon0:8PnOUaPMG/MchsZ4PlTFEmIKih4
TLSH
T18C263A5AA6B640E8D47AC038C583A12FF9B278A647305BCB56914F5B2F33BE45D3E350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2618592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

waveOutOpen waveOutClose waveOutGetErrorTextA timeGetTime mciGetErrorStringA waveOutUnprepareHeader waveOutPrepareHeader mciSendStringA waveOutWrite waveInGetNumDevs waveInGetDevCapsA waveInGetErrorTextA waveOutReset waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInReset

freeimage

FreeImage_Unload FreeImage_ConvertTo16Bits565 FreeImage_Save FreeImage_GetBits FreeImage_GetInfo FreeImage_Load

ss3dgfunc

SetRotationXMatrix SetRotationYMatrix Normalize RotatePositionWithPivot CalcDistance WriteTGA COLORtoDWORD MatrixMultiply2 VECTOR3Length CrossProduct TransformV3TOV4 TransformVector3_VPTR2 SetInverseMatrix

wsock32

inet_addr gethostbyname WSAStartup WSACleanup closesocket connect htons recv send socket ioctlsocket

dinput8

DirectInput8Create

kernel32

SetLastError RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetStartupInfoW GetTimeZoneInformation GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW TlsGetValue TlsSetValue VirtualProtect FlsFree FlsSetValue FlsGetValue CreateFileA GetFileAttributesA GetFileSize ReadFile OutputDebugStringA CloseHandle DebugBreak GetLocalTime OpenFile IsDBCSLeadByte GetEnvironmentVariableA SetEnvironmentVariableA GetTickCount GetPrivateProfileIntA CreateDirectoryA DeleteFileA MultiByteToWideChar WideCharToMultiByte LCMapStringA GetSystemDefaultLangID Sleep GlobalAlloc GlobalUnlock GlobalLock GetACP GetCurrentDirectoryA GetVolumeInformationA DecodePointer GetLastError CreatePipe InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject CreateProcessA GetStartupInfoA lstrlenA SetCurrentDirectoryA lstrcpyA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA VerSetConditionMask IsDebuggerPresent DuplicateHandle SetEvent ResetEvent CreateEventA WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess CreateThread ResumeThread InitializeCriticalSectionAndSpinCount GetProcessId OpenProcess TlsFree lstrcatA GetLogicalDriveStringsA QueryDosDeviceA VerifyVersionInfoA CreateToolhelp32Snapshot Process32First Process32Next Module32First Module32Next K32GetProcessImageFileNameA GetFullPathNameA GetTickCount64 VirtualQuery ReadProcessMemory K32GetModuleInformation lstrcpynA WriteFile QueryPerformanceCounter QueryPerformanceFrequency FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetModuleFileNameA LoadLibraryExA FileTimeToSystemTime RtlCaptureStackBackTrace AddVectoredExceptionHandler GetCurrentThread GetCurrentThreadId GetModuleHandleExA SetUnhandledExceptionFilter InitializeCriticalSection EnterCriticalSection LeaveCriticalSection FlushFileBuffers MoveFileExA SetFileAttributesA GetTempPathA CopyFileA GetFileSizeEx GetSystemTime K32GetModuleFileNameExA IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW GetModuleHandleW GetSystemTimeAsFileTime LCMapStringEx EncodePointer LocalFree GetProcessHeap TlsAlloc HeapReAlloc GetFileAttributesExW ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetModuleFileNameW GetStdHandle HeapFree HeapAlloc GetFileType CreateDirectoryW SetStdHandle HeapSize CreateFileW SetEndOfFile WriteConsoleW LoadLibraryExW FindFirstFileExW FlsAlloc IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW lstrcmpiA SetEnvironmentVariableW FindNextFileW SystemTimeToTzSpecificLocalTime GetPriorityClass RtlUnwind GetModuleHandleExW

user32

PeekMessageA DispatchMessageA TranslateMessage PtInRect GetAsyncKeyState IsIconic SendMessageA ReleaseDC GetDC OffsetRect LoadCursorFromFileA GetCursorPos ReleaseCapture SetCapture IsClipboardFormatAvailable DefWindowProcA PostQuitMessage EnumWindows FindWindowA GetWindowTextA CopyRect PostMessageA EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CharPrevA CharNextA MessageBoxA SetRect wsprintfA GetDesktopWindow GetForegroundWindow GetClassNameA RegisterHotKey RegisterClassExA CreateWindowExA SetCursor LoadIconA ShowCursor GetClientRect UpdateWindow DestroyWindow ShowWindow GetClipboardData GetSystemMetrics GetWindowThreadProcessId SetWinEventHook UnhookWinEvent ScreenToClient GetWindowInfo

gdi32

GetTextExtentPoint32A SelectObject AddFontResourceExA DeleteObject CreateFontIndirectA RemoveFontResourceExA GetStockObject

advapi32

OpenProcessToken RegOpenKeyExA RegCloseKey GetTokenInformation LookupAccountSidA GetUserNameA RegQueryInfoKeyA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoUninitialize CoFreeUnusedLibraries CoInitialize CoCreateInstance

dsound

ord11

iphlpapi

GetAdaptersInfo

shlwapi

StrCmpNIA

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

480KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

884KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2394e74880fdfbbda8d8c0bbf0bb6c8cd182175e6f215f2248828afaf50b9b9e

winmm

freeimage

ss3dgfunc

wsock32

dinput8

kernel32

user32

gdi32

advapi32

shell32

ole32

dsound

iphlpapi

shlwapi

generic