9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5

Sharing

Copy URL Twitter E-mail

General

Target
9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5
Size 1.8MB
Sample260930-yn9jastepd
SHA256 9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5
MD5 fdf6277b49fd723e0499406c54e4a14b
SHA1 26dccd58c1540788263c22e85b1a572ba19f01b9
SHA512 1c89ea96fbe1412e11dc7395e177f35a3ba8e44b1f22998e0e68f0857a72c39457110271284ddb03c7dafc837ad93abeeb0d2e5e1b9ac781df87e21538ff6065
SSDEEP 24576:anStrXhos1i7WhlNizrXAovUEcszbMDI:anS7oJ7WhvizrXAovUEcszbMDI
TLSH
T1AF95B541B3E95889EA7783398AB76231373AB941173AEB4F2204D5391D33EC07EB6715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5

File Explorer

9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5

.dll 1.8MB

9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5

IMPHASH ffe13ba1da6c88b0ad7d70a13b34341f
SHA256 9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5
MD5 fdf6277b49fd723e0499406c54e4a14b
SHA1 26dccd58c1540788263c22e85b1a572ba19f01b9
SHA512 1c89ea96fbe1412e11dc7395e177f35a3ba8e44b1f22998e0e68f0857a72c39457110271284ddb03c7dafc837ad93abeeb0d2e5e1b9ac781df87e21538ff6065
SSDEEP 24576:anStrXhos1i7WhlNizrXAovUEcszbMDI:anS7oJ7WhvizrXAovUEcszbMDI
TLSH
T1AF95B541B3E95889EA7783398AB76231373AB941173AEB4F2204D5391D33EC07EB6715
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ChangeServiceConfig2W CloseServiceHandle ControlService ConvertSidToStringSidW CreateProcessAsUserW CreateServiceW DeleteService EnumDependentServicesW GetServiceDisplayNameW GetTokenInformation GetUserNameW LookupAccountNameW MD5Final MD5Init MD5Update OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyExW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegGetValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW StartServiceW

cabinet

FDICreate FDICopy FDIDestroy

comctl32

ImageList_Add ImageList_Create ImageList_Destroy ImageList_ReplaceIcon

crypt32

CertDuplicateCertificateContext

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetObjectW GetStockObject GetTextMetricsW SelectObject SetBkMode SetTextColor StretchBlt

imagehlp

BindImage

kernel32

CloseHandle ConnectNamedPipe CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateNamedPipeW CreateProcessW CreateThread DebugBreak DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls DosDateTimeToFileTime DuplicateHandle EnterCriticalSection EnumResourceNamesW ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FindResourceExW FindResourceW FreeLibrary GetComputerNameW GetCurrentDirectoryW GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileSize GetFullPathNameW GetLocalTime GetLogicalDriveStringsW GetLogicalDrives GetModuleFileNameW GetModuleHandleW GetNativeSystemInfo GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDefaultLangID GetSystemDirectoryW GetSystemWow64DirectoryW GetTempFileNameW GetTempPathW GetTickCount GetTickCount64 GetTimeFormatW GetUserDefaultLangID GetVersion GetVolumeInformationW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW IsValidCodePage IsValidLocale IsWow64Process IsWow64Process2 LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFileTimeToFileTime LocalFree LockResource MapViewOfFile MoveFileExW MulDiv MultiByteToWideChar RaiseException ReadFile RemoveDirectoryW RtlUnwind SearchPathW SetFileAttributesW SetFilePointer SetFileTime SizeofResource Sleep SystemTimeToFileTime TzSpecificLocalTimeToSystemTime UnmapViewOfFile WaitForSingleObject WideCharToMultiByte Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteFile WritePrivateProfileStringW

mspatcha

ApplyPatchToFileW

ntdll

NtCreateSection NtQuerySection RtlGetVersion _vsnprintf

odbccp32

SQLConfigDataSourceW SQLRemoveTranslatorW SQLRemoveDriverW SQLInstallDriverExW SQLInstallTranslatorExW

ole32

CLSIDFromProgID CLSIDFromString CoCreateGuid CoCreateInstance CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize CreateILockBytesOnHGlobal CreateStreamOnHGlobal StgCreateDocfile StgOpenStorage StgOpenStorageOnILockBytes StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantInit VariantClear VariantCopy VariantCopyInd VariantChangeType DispGetParam SysAllocStringByteLen LoadTypeLib LoadRegTypeLib RegisterTypeLib LoadTypeLibEx SystemTimeToVariantTime VariantTimeToSystemTime UnRegisterTypeLib OleLoadPicture

rpcrt4

I_RpcExceptionFilter NdrClientCall2 NdrServerCall2 RpcBindingFree RpcBindingFromStringBindingW RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqEpW RpcStringBindingComposeW RpcStringFreeW

shell32

SHGetFolderPathW ShellExecuteW

shlwapi

PathAddBackslashW PathAppendW PathFindFileNameW PathIsRelativeW PathRemoveBackslashW PathRemoveFileSpecW PathStripPathW PathStripToRootW SHCreateStreamOnFileW StrFormatByteSizeW UrlIsW

sxs

CreateAssemblyCache

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _assert _strdup _wcsdup _wcsicmp _wcsnicmp _wcsupr _wtoi bsearch calloc free fwrite getenv iswdigit iswspace malloc memcmp memcpy memmove memset qsort realloc strcat strchr strcmp strcpy strcspn strlen strtol towupper wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcsstr wcstol

urlmon

URLDownloadToCacheFileW

user32

AdjustWindowRect AppendMenuA CallWindowProcW CharLowerW CharUpperW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW EnableWindow EnumChildWindows GetClientRect GetDC GetFocus GetNextDlgTabItem GetParent GetPropW GetWindowLongPtrW GetWindowRect GetWindowTextW InvalidateRect IsDialogMessageW LoadBitmapW LoadCursorW LoadIconW LoadImageW LoadStringW MapWindowPoints MessageBoxExA MessageBoxExW MessageBoxW MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW RegisterClassW ReleaseDC RemovePropW SendMessageW SetFocus SetPropW SetWindowLongPtrW SetWindowPos SetWindowTextW ShowWindow TrackPopupMenu TranslateMessage UnregisterClassW wsprintfA wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

GetUrlCacheEntryInfoW

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrustEx

DllCanUnloadNow DllGetClassObject DllGetVersion DllRegisterServer DllUnregisterServer Migrate10CachedPackagesA Migrate10CachedPackagesW MsiAdvertiseProductA MsiAdvertiseProductExA MsiAdvertiseProductExW MsiAdvertiseProductW MsiAdvertiseScriptA MsiAdvertiseScriptW MsiApplyMultiplePatchesA MsiApplyMultiplePatchesW MsiApplyPatchA MsiApplyPatchW MsiBeginTransactionA MsiBeginTransactionW MsiCloseAllHandles MsiCloseHandle MsiCollectUserInfoA MsiCollectUserInfoW MsiConfigureFeatureA MsiConfigureFeatureFromDescriptorA MsiConfigureFeatureFromDescriptorW MsiConfigureFeatureW MsiConfigureProductA MsiConfigureProductExA MsiConfigureProductExW MsiConfigureProductW MsiCreateAndVerifyInstallerDirectory MsiCreateRecord MsiCreateTransformSummaryInfoA MsiCreateTransformSummaryInfoW MsiDatabaseApplyTransformA MsiDatabaseApplyTransformW MsiDatabaseCommit MsiDatabaseExportA MsiDatabaseExportW MsiDatabaseGenerateTransformA MsiDatabaseGenerateTransformW MsiDatabaseGetPrimaryKeysA MsiDatabaseGetPrimaryKeysW MsiDatabaseImportA MsiDatabaseImportW MsiDatabaseIsTablePersistentA MsiDatabaseIsTablePersistentW MsiDatabaseMergeA MsiDatabaseMergeW MsiDatabaseOpenViewA MsiDatabaseOpenViewW MsiDecomposeDescriptorA MsiDecomposeDescriptorW MsiDeleteUserDataA MsiDeleteUserDataW MsiDetermineApplicablePatchesA MsiDetermineApplicablePatchesW MsiDeterminePatchSequenceA MsiDeterminePatchSequenceW MsiDoActionA MsiDoActionW MsiEnableLogA MsiEnableLogW MsiEnableUIPreview MsiEndTransaction MsiEnumClientsA MsiEnumClientsExA MsiEnumClientsExW MsiEnumClientsW MsiEnumComponentCostsA MsiEnumComponentCostsW MsiEnumComponentQualifiersA MsiEnumComponentQualifiersW MsiEnumComponentsA MsiEnumComponentsExA MsiEnumComponentsExW MsiEnumComponentsW MsiEnumFeaturesA MsiEnumFeaturesW MsiEnumPatchesA MsiEnumPatchesExA MsiEnumPatchesExW MsiEnumPatchesW MsiEnumProductsA MsiEnumProductsExA MsiEnumProductsExW MsiEnumProductsW MsiEnumRelatedProductsA MsiEnumRelatedProductsW MsiEvaluateConditionA MsiEvaluateConditionW MsiExtractPatchXMLDataA MsiExtractPatchXMLDataW MsiFormatRecordA MsiFormatRecordW MsiGetActiveDatabase MsiGetComponentPathA MsiGetComponentPathExA MsiGetComponentPathExW MsiGetComponentPathW MsiGetComponentStateA MsiGetComponentStateW MsiGetDatabaseState MsiGetFeatureCostA MsiGetFeatureCostW MsiGetFeatureInfoA MsiGetFeatureInfoW MsiGetFeatureStateA MsiGetFeatureStateW MsiGetFeatureUsageA MsiGetFeatureUsageW MsiGetFeatureValidStatesA MsiGetFeatureValidStatesW MsiGetFileHashA MsiGetFileHashW MsiGetFileSignatureInformationA MsiGetFileSignatureInformationW MsiGetFileVersionA MsiGetFileVersionW MsiGetLanguage MsiGetLastErrorRecord MsiGetMode MsiGetPatchFileListA MsiGetPatchFileListW MsiGetPatchInfoA MsiGetPatchInfoExA MsiGetPatchInfoExW MsiGetPatchInfoW MsiGetProductCodeA MsiGetProductCodeFromPackageCodeA MsiGetProductCodeFromPackageCodeW MsiGetProductCodeW MsiGetProductInfoA MsiGetProductInfoExA MsiGetProductInfoExW MsiGetProductInfoFromScriptA MsiGetProductInfoFromScriptW MsiGetProductInfoW MsiGetProductPropertyA MsiGetProductPropertyW MsiGetPropertyA MsiGetPropertyW MsiGetShortcutTargetA MsiGetShortcutTargetW MsiGetSourcePathA MsiGetSourcePathW MsiGetSummaryInformationA MsiGetSummaryInformationW MsiGetTargetPathA MsiGetTargetPathW MsiGetUserInfoA MsiGetUserInfoW MsiInstallMissingComponentA MsiInstallMissingComponentW MsiInstallMissingFileA MsiInstallMissingFileW MsiInstallProductA MsiInstallProductW MsiInvalidateFeatureCache MsiIsProductElevatedA MsiIsProductElevatedW MsiJoinTransaction MsiLoadStringA MsiLoadStringW MsiLocateComponentA MsiLocateComponentW MsiMessageBoxA MsiMessageBoxExA MsiMessageBoxExW MsiMessageBoxW MsiNotifySidChangeA MsiNotifySidChangeW MsiOpenDatabaseA MsiOpenDatabaseW MsiOpenPackageA MsiOpenPackageExA MsiOpenPackageExW MsiOpenPackageW MsiOpenProductA MsiOpenProductW MsiPreviewBillboardA MsiPreviewBillboardW MsiPreviewDialogA MsiPreviewDialogW MsiProcessAdvertiseScriptA MsiProcessAdvertiseScriptW MsiProcessMessage MsiProvideAssemblyA MsiProvideAssemblyW MsiProvideComponentA MsiProvideComponentFromDescriptorA MsiProvideComponentFromDescriptorW MsiProvideComponentW MsiProvideQualifiedComponentA MsiProvideQualifiedComponentExA MsiProvideQualifiedComponentExW MsiProvideQualifiedComponentW MsiQueryComponentStateA MsiQueryComponentStateW MsiQueryFeatureStateA MsiQueryFeatureStateExA MsiQueryFeatureStateExW MsiQueryFeatureStateFromDescriptorA MsiQueryFeatureStateFromDescriptorW MsiQueryFeatureStateW MsiQueryProductStateA MsiQueryProductStateW MsiRecordClearData MsiRecordDataSize MsiRecordGetFieldCount MsiRecordGetInteger MsiRecordGetStringA MsiRecordGetStringW MsiRecordIsNull MsiRecordReadStream MsiRecordSetInteger MsiRecordSetStreamA MsiRecordSetStreamW MsiRecordSetStringA MsiRecordSetStringW MsiReinstallFeatureA MsiReinstallFeatureFromDescriptorA MsiReinstallFeatureFromDescriptorW MsiReinstallFeatureW MsiReinstallProductA MsiReinstallProductW MsiRemovePatchesA MsiRemovePatchesW MsiSequenceA MsiSequenceW MsiSetComponentStateA MsiSetComponentStateW MsiSetExternalUIA MsiSetExternalUIRecord MsiSetExternalUIW MsiSetFeatureAttributesA MsiSetFeatureAttributesW MsiSetFeatureStateA MsiSetFeatureStateW MsiSetInstallLevel MsiSetInternalUI MsiSetMode MsiSetOfflineContextW MsiSetPropertyA MsiSetPropertyW MsiSetTargetPathA MsiSetTargetPathW MsiSourceListAddMediaDiskA MsiSourceListAddMediaDiskW MsiSourceListAddSourceA MsiSourceListAddSourceExA MsiSourceListAddSourceExW MsiSourceListAddSourceW MsiSourceListClearAllA MsiSourceListClearAllExA MsiSourceListClearAllExW MsiSourceListClearAllW MsiSourceListClearMediaDiskA MsiSourceListClearMediaDiskW MsiSourceListClearSourceA MsiSourceListClearSourceW MsiSourceListEnumMediaDisksA MsiSourceListEnumMediaDisksW MsiSourceListEnumSourcesA MsiSourceListEnumSourcesW MsiSourceListForceResolutionA MsiSourceListForceResolutionExA MsiSourceListForceResolutionExW MsiSourceListForceResolutionW MsiSourceListGetInfoA MsiSourceListGetInfoW MsiSourceListSetInfoA MsiSourceListSetInfoW MsiSummaryInfoGetPropertyA MsiSummaryInfoGetPropertyCount MsiSummaryInfoGetPropertyW MsiSummaryInfoPersist MsiSummaryInfoSetPropertyA MsiSummaryInfoSetPropertyW MsiUseFeatureA MsiUseFeatureExA MsiUseFeatureExW MsiUseFeatureW MsiVerifyDiskSpace MsiVerifyPackageA MsiVerifyPackageW MsiViewClose MsiViewExecute MsiViewFetch MsiViewGetColumnInfo MsiViewGetErrorA MsiViewGetErrorW MsiViewModify QueryInstanceCount __wine_msi_call_dll_function

Name

.text

Size

604KB

Virtual Size

601KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

184KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/122483

Size

4KB

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

24KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

12KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

324KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9d14120012d4987867635e5b36ae7de300d16b231e83320bab7b9fd783cc49a5

advapi32

cabinet

comctl32

crypt32

gdi32

imagehlp

kernel32

mspatcha

ntdll

odbccp32

ole32

oleaut32

rpcrt4

shell32

shlwapi

sxs

ucrtbase

urlmon

user32

version

wininet

wintrust

generic