5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1

Sharing

Copy URL Twitter E-mail

General

Target
5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1
Size 604KB
Sample260930-ymfvlazthy
SHA256 5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1
MD5 8d0180fb884dcfbc7d3fc3a6fff0f469
SHA1 d82fab51bfa023e607cbd1a064aadcab8053269c
SHA512 2d96c8785259a1ecbb2d04a7078da1a537e2e440b980cc3d5729e14b034ba0ad85801a4c61eb1e02ce4fb52143d3524b07a126b75e4be148307fb8b1bea0d546
SSDEEP 3072:8May7BqLxIAtaWY4YDDfd88VvlzaOI2qdcsAghV0ezVRxaz0bNIESdtBwj6ftHBn:lam0LxaxaOa5SOrSGm+99n0B
TLSH
T179D4639077E49897F576433848E7E2313B39FA814762CB0BD500A53D1D27BC2AFA5B92
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1

File Explorer

5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1

.dll 604KB

5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1

IMPHASH 204874338c62b6d9578c1ef8571913ed
SHA256 5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1
MD5 8d0180fb884dcfbc7d3fc3a6fff0f469
SHA1 d82fab51bfa023e607cbd1a064aadcab8053269c
SHA512 2d96c8785259a1ecbb2d04a7078da1a537e2e440b980cc3d5729e14b034ba0ad85801a4c61eb1e02ce4fb52143d3524b07a126b75e4be148307fb8b1bea0d546
SSDEEP 3072:8May7BqLxIAtaWY4YDDfd88VvlzaOI2qdcsAghV0ezVRxaz0bNIESdtBwj6ftHBn:lam0LxaxaOa5SOrSGm+99n0B
TLSH
T179D4639077E49897F576433848E7E2313B39FA814762CB0BD500A53D1D27BC2AFA5B92
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueW

comctl32

PropertySheetW

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear VariantCopy VariantChangeType SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement VarI2FromUI1 VarI2FromI4 VarI2FromR4 VarI2FromR8 VarI2FromCy VarI2FromDate VarI2FromStr VarI2FromBool VarI4FromUI1 VarI4FromI2 VarI4FromR4 VarI4FromR8 VarI4FromCy VarI4FromDate VarI4FromStr VarI4FromBool VarR4FromUI1 VarR4FromI2 VarR4FromI4 VarR4FromR8 VarR4FromCy VarR4FromDate VarR4FromStr VarR4FromBool VarR8FromUI1 VarR8FromI2 VarR8FromI4 VarR8FromR4 VarR8FromCy VarR8FromDate VarR8FromStr VarR8FromBool VarDateFromUI1 VarDateFromI2 VarDateFromI4 VarDateFromR4 VarDateFromR8 VarDateFromCy VarDateFromStr VarDateFromBool VarCyFromUI1 VarCyFromI2 VarCyFromI4 VarCyFromR4 VarCyFromR8 VarCyFromDate VarCyFromStr VarCyFromBool VarBstrFromUI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarBstrFromCy VarBstrFromDate VarBstrFromBool VarBoolFromUI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromR4 VarBoolFromR8 VarBoolFromDate VarBoolFromCy VarBoolFromStr VarUI1FromI2 VarUI1FromI4 VarUI1FromR4 VarUI1FromR8 VarUI1FromCy VarUI1FromDate VarUI1FromStr VarUI1FromBool SystemTimeToVariantTime VariantTimeToSystemTime VarI2FromI1 VarI2FromUI2 VarI2FromUI4 VarI2FromDec VarI4FromI1 VarI4FromUI2 VarI4FromUI4 VarI4FromDec VarR4FromI1 VarR4FromUI2 VarR4FromUI4 VarR4FromDec VarR8FromI1 VarR8FromUI2 VarR8FromUI4 VarR8FromDec VarDateFromI1 VarDateFromUI2 VarDateFromUI4 VarDateFromDec VarCyFromI1 VarCyFromUI2 VarCyFromUI4 VarCyFromDec VarBstrFromI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromDec VarBoolFromI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromDec VarUI1FromI1 VarUI1FromUI2 VarUI1FromUI4 VarUI1FromDec VarI1FromUI1 VarI1FromI2 VarI1FromI4 VarI1FromR4 VarI1FromR8 VarI1FromDate VarI1FromCy VarI1FromStr VarI1FromBool VarI1FromUI2 VarI1FromUI4 VarI1FromDec VarUI2FromUI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromR4 VarUI2FromR8 VarUI2FromDate VarUI2FromCy VarUI2FromStr VarUI2FromBool VarUI2FromI1 VarUI2FromUI4 VarUI2FromDec VarUI4FromUI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromR4 VarUI4FromR8 VarUI4FromDate VarUI4FromCy VarUI4FromStr VarUI4FromBool VarUI4FromI1 VarUI4FromUI2 VarUI4FromDec VarI8FromStr VarI2FromI8 VarI2FromUI8 VarI4FromI8 VarI4FromUI8 VarR4FromI8 VarR4FromUI8 VarR8FromI8 VarR8FromUI8 VarDateFromI8 VarDateFromUI8 VarCyFromI8 VarCyFromUI8 VarBstrFromI8 VarBstrFromUI8 VarBoolFromI8 VarBoolFromUI8 VarUI1FromI8 VarUI1FromUI8 VarDecFromI8 VarI1FromI8 VarI1FromUI8 VarUI2FromI8 VarUI2FromUI8 VarUI4FromI8 VarUI4FromUI8 VarUI8FromI8 VarUI8FromUI1 VarUI8FromI2 VarUI8FromR4 VarUI8FromR8 VarUI8FromCy VarUI8FromDate VarUI8FromStr VarUI8FromBool VarUI8FromI1 VarUI8FromUI2 VarUI8FromUI4 VarUI8FromDec

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _strdup _wcsdup _wcsicmp bsearch calloc free fwrite getenv iswspace malloc memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen wcscat wcschr wcscpy wcsstr

user32

CharLowerW EnableWindow GetDlgItem GetParent GetWindowRect LoadStringW MessageBoxA MessageBoxW SendMessageA SendMessageW SetWindowLongPtrW wsprintfW

Name

.text

Size

64KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

80KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

116KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

380B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5b7f76b7a03c4051991a7044dbe9c35caf7483ec101c2fc18b66b317418c34a1

advapi32

comctl32

kernel32

ntdll

ole32

oleaut32

ucrtbase

user32

generic