94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a

Sharing

Copy URL Twitter E-mail

General

Target
94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a
Size 8.1MB
Sample260930-t251tada72
SHA256 94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a
MD5 524877915b91659f497ab50dacf22488
SHA1 913f4aba959d1577487a9774a6174f6b494b62d7
SHA512 a435ee48a6efaa2801018fd3cbe36a3bac264439920003e22ac8456abc32100c64a738eb22fd642a7d50e965e3b33f6ce42a80e0474fd1dc58391c1b08bfb3ae
SSDEEP 196608:fzonj1KsvOfYVIDHglBWs+KJ51WZFORX4:fIMGOfYAAPdVWit4
TLSH
T1B186337326E41049C0EAC93CC533FDE572F6136F9A52AC789589BAC53D126F6E703982
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a

File Explorer

94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a

.dll 8.1MB

94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a

IMPHASH 021ef37d715d8c362bcb8522cc0846d7
SHA256 94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a
MD5 524877915b91659f497ab50dacf22488
SHA1 913f4aba959d1577487a9774a6174f6b494b62d7
SHA512 a435ee48a6efaa2801018fd3cbe36a3bac264439920003e22ac8456abc32100c64a738eb22fd642a7d50e965e3b33f6ce42a80e0474fd1dc58391c1b08bfb3ae
SSDEEP 196608:fzonj1KsvOfYVIDHglBWs+KJ51WZFORX4:fIMGOfYAAPdVWit4
TLSH
T1B186337326E41049C0EAC93CC533FDE572F6136F9A52AC789589BAC53D126F6E703982
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7903606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcpynA SetLastError FileTimeToLocalFileTime FileTimeToSystemTime LocalFree InterlockedDecrement SuspendThread ReleaseMutex CreateMutexA TerminateThread GetCurrentProcess GetWindowsDirectoryA GetSystemDirectoryA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile SetStdHandle IsBadCodePtr IsBadReadPtr CompareStringW CompareStringA SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA IsBadWritePtr VirtualAlloc LCMapStringW LCMapStringA SetEnvironmentVariableA VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetACP HeapSize TerminateProcess RaiseException WaitForMultipleObjects CreateFileA SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA SetCurrentDirectoryA GetLocalTime GetSystemTime GetTimeZoneInformation RtlUnwind GetOEMCP GetCPInfo GetProcessVersion SetErrorMode GlobalFlags GetCurrentThread GetFileTime GetFileSize TlsGetValue LocalReAlloc TlsSetValue TlsFree GlobalHandle TlsAlloc LocalAlloc lstrcmpA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount WaitForSingleObject CloseHandle lstrcmpiA DuplicateHandle SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer InterlockedIncrement VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetCursorPos MessageBoxA SetWindowPos SendMessageA DestroyCursor SetParent IsWindow PostMessageA GetTopWindow GetParent GetFocus GetClientRect InvalidateRect ValidateRect UpdateWindow EqualRect GetWindowRect SetForegroundWindow DestroyMenu EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA GetSystemMetrics IsChild ReleaseDC IsRectEmpty FillRect GetDC SetCursor LoadCursorA SetCursorPos SetActiveWindow GetSysColor SetWindowLongA GetWindowLongA RedrawWindow EnableWindow IsWindowVisible OffsetRect PtInRect DestroyIcon IntersectRect InflateRect SetRect SetScrollPos SetScrollRange GetScrollRange SetCapture GetCapture ReleaseCapture SetTimer KillTimer WinHelpA GetForegroundWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx CreateIconFromResource DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetMenu SetMenu PeekMessageA IsIconic GetWindowTextA GetWindowTextLengthA CharUpperA GetWindowDC BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA GetDlgItem DestroyWindow CreateDialogIndirectParamA EndDialog GetNextDlgTabItem GetWindowPlacement RegisterWindowMessageA GetLastActivePopup GetMessageTime RemovePropA CallWindowProcA GetPropA UnhookWindowsHookEx SetPropA GetClassLongA CallNextHookEx SetWindowsHookExA CreateWindowExA GetMenuItemID GetMenuItemCount RegisterClassA GetScrollPos AdjustWindowRectEx MapWindowPoints SendDlgItemMessageA ScrollWindowEx IsDialogMessageA SetWindowTextA MoveWindow CheckMenuItem SetMenuItemBitmaps GetMenuState GetMenuCheckMarkDimensions GetClassNameA GetDesktopWindow UnregisterClassA LoadStringA GetSysColorBrush SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

gdi32

SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateEllipticRgn CreateRoundRectRgn GetTextColor GetBkMode GetBkColor GetROP2 GetStretchBltMode GetPolyFillMode CreateCompatibleBitmap CreateDCA CreateBitmap SelectObject CreatePen PatBlt CombineRgn CreateRectRgn FillRgn CreateSolidBrush CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc CreateRectRgnIndirect StartDocA StartPage StretchBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect MoveToEx LineTo CreatePalette GetSystemPaletteEntries CreateDIBitmap DeleteObject SelectClipRgn CreatePolygonRgn GetClipRgn SetStretchBltMode BitBlt SetBkColor DeleteDC GetTextMetricsA Escape ExtTextOutA TextOutA RectVisible PtVisible GetViewportExtEx ExtSelectClipRgn

winmm

midiStreamRestart midiStreamClose midiOutReset midiStreamStop midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader waveOutRestart

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegQueryValueA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegCreateKeyExA

shell32

Shell_NotifyIconA SHGetSpecialFolderPathA ShellExecuteA

ole32

CLSIDFromProgID OleInitialize OleUninitialize CLSIDFromString CoCreateInstance OleRun

oleaut32

VariantClear VariantChangeType SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement RegisterTypeLi LHashValOfNameSys LoadTypeLi UnRegisterTypeLi

comctl32

ord17 ImageList_Destroy

ws2_32

inet_ntoa WSACleanup closesocket WSAAsyncSelect recvfrom ntohl accept getpeername ioctlsocket recv

comdlg32

GetFileTitleA GetOpenFileNameA ChooseColorA GetSaveFileNameA

wtsapi32

WTSSendMessageW

Q��!~�)�ت|�EK+Re,J��Q��D�'>i#�P�.t�+L�pT�t��Z1�뵴�� @S��0ū?�WL��Z��?�h�4=Fb2"�I?�?Ήﾴ��E�h �e��g;��$��`��5�a�_"�'��}��uF�i��w�:�ja�-�� P� 9��+E��ZR��RNbqF��B�r�p�1�sKn��P#�Ϊ$�t��J��:bV�C��.�1>��E� 4��/A+�'�V��VE�8�-��K�KP��z�HpB_�?TD+� 0f,��~��X��g��(i��pzR:w��G�V�O�yL5q��t��"(�4�" qQ_��_��ݶ�q[��x ��~�ɝwhܙ��j1wޘ��)E9�#jajS�©�H�\bT[<��ȃ��闘��oʾ�%�٦�*.i��x��D�q�K��$��@ƃ҂��/�G��T-�U��tB[>0q��MA��|g�1��=L��|�x��fT�~YI]��R�d�T/�K��{rc�`��(�*Ǻn�i��;7=��}J�~Q(�Zć��'�3ġ\�d�_q�F#��3T�+��!}�,36L9k�-�qGbx��#a��~L�K�j�� ̷n� W�y��[I��2UQڊ{��t<d�Ӄ�5��#� ?&%�9N+�I�B�+� ��S>i�5��5gga��3Ҡ� ��Fv��M�Mv˼��Ho�B�n�#�� è�<*�ͼ��ky�$"u�γ}FW�/E��O��Oyԥv/�.?ϱ�UG��=��r+��k�!,�^}�`h�y>��&;ɧ��dW�#z&�coQ� ��o�/��m��7i��:e^�6�Z`��%U�4�צ�oJ��B�^�W��/�:�_��Ո��A�Ҳ>�.S�n��ъ��ކH��Z\vi�L�}U� �$<"c�4G�JVS^^G%��k{M�5��<��?��Q ڍ�z*h;��:.��<�� ڏ�v=��b�ǉ��̜i&@�7~#�,MĀ��.��⻔��=�K��lABb1�ō'g��,�[�?;�4_T��Nߛ�-�.��tj{(��.�y)��e8'��N��z׽�\:��T�H��Y�tVSp'�P�y�z��}�)�n�!-!#L�7�|�5��p>]Ar+=��S�تqL��^��`tO�� .�.>�*��IlU��4)�^�g�̜է��R��y;��-�G�ӳՅ��dc�?��0��&Q�߼�� ?-D��^6n�*�כ�6E�9t�e��|��4��y.��L�k�B�+��}�1�g��zA�� M�m��Yq��:!m�L"��`�H��X�|^��ď��h��ؘ4��I��i��A�b]͇��&s�0}��wŁ��?Ju��'2��C��I[o��{��t=av��lqjh�A⧑I��ao��x[��R$�%�h��OU��#.��S��# �x�^��H��wfH<`�%(��y�p绊�撃=u��t��}�JⳂaj��[��!q�&��qFa��_��K� ��S�H%��4�+~��d̨F�ߣOqy\;O��3Ca��i�H Vv/��6[U'M��)$�_��ͷ~}��V�CFd{z��~�T�"�9��c`ipWC��O��r�n8�I��W��i��EԹ=e�vQc�Z�i��u�5P�'�PT<��r f�:OH�eKql��˘S ��W�!W]��0,��`�c�/y��PO@b��J˹B�'��QS��~��D��<�"~��~K��h�?�{� �@pÁ�M�U��N�Fr]g�Qw��(D&5��)�}e�@L#�0ѐ��Xu��m�C�m[H��s��$�#+�t8��/��/��n!"�� /��P{Q'Sڑ�٩u�G��ޛ�Au�t}��;��3�ǘO2�F쫕��F��;*��ih:��u��+�<ud=�!�d�u�2��F��w��Q��s��!�'�b��$�]paLoQ��!i<J�Uカ<H�7`A7S�|3��T�os��a�I`]�{�$��A��ع��W��=�w0��U��(��5��5݂��~!��Us3>��!y�:Oq�j�XE��k��WF*�:�=\͔ۤ��kp�o��w͇��]OϵK�:�o�b&j*`@��i�:/��j\u(�oT;Z�72Џ��ƈ��_� ��G�ޝ��.;p�+��t�0�Ģ�6+B��{�a�� j��hԪ��x�2�?��H��X予7�_5��l��s�0��gA9�S�aAK fqf�0�@�!Q,��*M�&�t�U�:�Pt�B��7�E�� '}E)�/�z��^�E��Ƞ��9:�ڊ��.�{��\��B��1� �GE�oCr+�Ʃ�[�6��z��G7��"��h-jc��wYY�zf�T��"NI��`W�k��)��4͋��ܻ��h�Zc��(��L ��qN��;�==}��QӊFVkb��,��g��ͷiu�mh��ԟ(ϱP\��`(��G��S�1r�%�-��v�0�4q/cE�@o*D� �a�Z��!�f߄��Sb��D��-M��]�_��So§��n ]�� b�e�O�r�Q,��G�+�)]�^H��s-��9�gn��Gz��h�F��3ê��x^�)�O�ֱ(ʶwq��Wu��+��iIk0a�2�!$�[��c��c��f_fF��<B)��)��u�)�x7��u��į� �>�� O~� �j��±CX��F�G��g��zZs[3+rP��0��;՝�q/aa�� X��}��E24rXF� 1he�3R�8"q?��B�d�JJh W2A �ļ�_��ӳ��s �ļ�_��ȡӳ��

Name

.text

Size

Virtual Size

739KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.svmp0

Size

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.svmp1

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

94fc4f8d676d9fbde5e9a0dc82bf2c04e14f4b33b2197d651ecdced33bf70c4a

kernel32

user32

gdi32

winmm

winspool.drv

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

comdlg32

wtsapi32

generic