3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2

Sharing

Copy URL Twitter E-mail

General

Target
3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2
Size 5.3MB
Sample260930-v855tssx3n
SHA256 3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2
MD5 091e829ddfd1187d27c4073c73363d2d
SHA1 ec97f5caf41c995d2aec3f72be5209757f88e87d
SHA512 fda885853134eb8b2e7a1ed49b8b5d0c411da6c90e246469bfe011740a6e6faf7a5c90dc91cff1e3ce6778183465381ccd4a1e46a460118dcbf99afa77a3a75d
SSDEEP 49152:B5PcmcjNBgRup9AE8N70OcKn+HwQPclgOvLGTyYCwU3mmudag5tEcfUNTjTHIdEa:fYyYCt3gEcfUNTHIKiV4JA
TLSH
T12C468D59B2CC6951E47981388F2AE652E7327C854F2163DF6080772E6E3BCF42E3E645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2

File Explorer

3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2

.exe 5.3MB

3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2

IMPHASH 6a86d50280fbe201a9d940dcf8cdd73e
SHA256 3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2
MD5 091e829ddfd1187d27c4073c73363d2d
SHA1 ec97f5caf41c995d2aec3f72be5209757f88e87d
SHA512 fda885853134eb8b2e7a1ed49b8b5d0c411da6c90e246469bfe011740a6e6faf7a5c90dc91cff1e3ce6778183465381ccd4a1e46a460118dcbf99afa77a3a75d
SSDEEP 49152:B5PcmcjNBgRup9AE8N70OcKn+HwQPclgOvLGTyYCwU3mmudag5tEcfUNTjTHIdEa:fYyYCt3gEcfUNTHIKiV4JA
TLSH
T12C468D59B2CC6951E47981388F2AE652E7327C854F2163DF6080772E6E3BCF42E3E645
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1530432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OpenEventW FileTimeToLocalFileTime GetSystemTimeAsFileTime LocalFree FormatMessageW CreateThread ExpandEnvironmentStringsW DeleteFileW GetTempPathW GetSystemDirectoryW GetWindowsDirectoryW CopyFileW MoveFileW GetTimeZoneInformation IsDebuggerPresent LeaveCriticalSection SetEvent WaitForMultipleObjects MulDiv GetCurrentThreadId FreeResource LoadResource LockResource SizeofResource FindResourceW GetUserDefaultLCID GetStdHandle GetCommandLineW CreateDirectoryW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW SetLastError CreatePipe PeekNamedPipe GetExitCodeProcess GetSystemInfo VirtualQuery GlobalFlags IsBadReadPtr HeapAlloc HeapReAlloc HeapFree GetProcessHeap ResetEvent GlobalDeleteAtom GlobalAddAtomW GetLocalTime FileTimeToSystemTime DisconnectNamedPipe CreateNamedPipeW WaitNamedPipeW GetNamedPipeInfo VirtualAlloc VirtualProtect VirtualFree CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile LoadLibraryA LoadLibraryExA WriteConsoleW HeapSize SetEnvironmentVariableW WriteFile GetEnvironmentStringsW FindFirstFileExW GetOEMCP GetACP IsValidCodePage SetEndOfFile SetStdHandle GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread ExitThread HeapCompact FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionEx K32GetProcessMemoryInfo Process32NextW Process32FirstW CreateToolhelp32Snapshot QueryFullProcessImageNameW GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetProcAddress FreeLibrary SetProcessWorkingSetSize GetTickCount64 GetTickCount OpenProcess CreateProcessW TerminateProcess ExitProcess GetModuleFileNameW GetCurrentProcessId GetCurrentProcess CreateEventW Sleep WaitForSingleObject DeleteCriticalSection TryEnterCriticalSection EnterCriticalSection InitializeCriticalSection GetLastError CloseHandle ReadFile GetFileSizeEx FindNextFileW FindFirstFileW FindClose CreateFileW QueryPerformanceCounter InitOnceComplete InitOnceBeginInitialize AcquireSRWLockExclusive ReleaseSRWLockExclusive GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar LoadLibraryW GetModuleHandleW FreeEnvironmentStringsW RtlUnwind

user32

GetParent LoadCursorW LoadIconW LoadImageW SetPropW OpenClipboard DefWindowProcW CreateWindowExW GetClassInfoW IsWindow DestroyWindow SetWindowPos IsWindowVisible GetKeyState GetSystemMetrics GetForegroundWindow SetForegroundWindow GetDC ReleaseDC RemovePropW GetWindowTextW GetClientRect GetWindowRect ClientToScreen GetWindowLongPtrW SetWindowLongPtrW EnumWindows GetClassNameW GetWindowThreadProcessId GetWindow WaitForInputIdle wsprintfW GetMessageW TranslateMessage DispatchMessageW PeekMessageW SetTimer KillTimer SetFocus SetClipboardData EmptyClipboard GetActiveWindow GetFocus MessageBoxW RegisterClassW SendMessageW LoadStringW GetDesktopWindow PostMessageW RegisterWindowMessageW GetPropW CloseClipboard UnregisterHotKey RegisterHotKey MonitorFromWindow GetCursorPos

gdi32

SetDIBColorTable CreateDIBSection GetStockObject GetDeviceCaps SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt GetObjectW

advapi32

RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCreateKeyW RegDeleteKeyW RegDeleteValueW RegQueryValueW RegCloseKey RegSetValueExW

shell32

DragQueryFileW DragFinish SHFileOperationW SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteW DragQueryFileA

ole32

CoInitializeEx CoUninitialize GetHGlobalFromStream CreateStreamOnHGlobal

oleaut32

VarUdateFromDate SystemTimeToVariantTime VariantTimeToSystemTime

comctl32

ImageList_Destroy ImageList_AddMasked ImageList_Create

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpWebSocketQueryCloseStatus WinHttpWebSocketSend WinHttpWebSocketCompleteUpgrade WinHttpQueryHeaders WinHttpSendRequest WinHttpWebSocketReceive WinHttpWebSocketClose WinHttpOpenRequest WinHttpReceiveResponse WinHttpSetTimeouts WinHttpSetOption WinHttpConnect WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpen

shlwapi

PathFileExistsW PathMatchSpecW

gdiplus

GdipGetImageEncoders GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipDrawImageRectI GdipSetCompositingMode GdipDeleteGraphics GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromFile GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipGetImageGraphicsContext GdipSaveImageToFile GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipImageSelectActiveFrame GdipSaveImageToStream GdipAlloc

dsound

ord11

ws2_32

WSACleanup

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

497KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.snhfp01

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3b6677a1e3f4f30b1ff75091188220bd36ba195bd2128f264bc048aff82552b2

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

version

winhttp

shlwapi

gdiplus

dsound

ws2_32

generic