4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f

Sharing

Copy URL Twitter E-mail

General

Target
4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f
Size 1.3MB
Sample260930-ysrt2sz1cs
SHA256 4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f
MD5 f6c67f51378ed4a349c46c86a8c25e39
SHA1 5e6040711268ca6e979cee08a74cc4b19860de2b
SHA512 c60e59c24e0671d92ea14da44937804be2b666c7fe49b5808a0417d3f4d205653f3a355684e1f9100af6d0a024802515f4d96a9e0e4a64c4537a037c1b1be2e6
SSDEEP 6144:yBtbvs7vIoLbKNQ6EdMLBukkPP789lS7v9g4oFY:yB9OIoL6gkk3uoG4oe
TLSH
T10555B911E3EC8A16F6F36B3C59BA62512E36BD91AA35CB0F4200656D08F1FD4ED64723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f

File Explorer

4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f

.dll 1.3MB

4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f

IMPHASH f4d696bc4543deaf5af9716883a42dc2
SHA256 4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f
MD5 f6c67f51378ed4a349c46c86a8c25e39
SHA1 5e6040711268ca6e979cee08a74cc4b19860de2b
SHA512 c60e59c24e0671d92ea14da44937804be2b666c7fe49b5808a0417d3f4d205653f3a355684e1f9100af6d0a024802515f4d96a9e0e4a64c4537a037c1b1be2e6
SSDEEP 6144:yBtbvs7vIoLbKNQ6EdMLBukkPP789lS7v9g4oFY:yB9OIoL6gkk3uoG4oe
TLSH
T10555B911E3EC8A16F6F36B3C59BA62512E36BD91AA35CB0F4200656D08F1FD4ED64723
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextW CryptDestroyKey CryptGetKeyParam CryptGetUserKey CryptReleaseContext CryptSetProvParam RegCloseKey RegCreateKeyExW RegDeleteValueA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy ImageList_SetBkColor PropertySheetW

comdlg32

GetOpenFileNameW GetSaveFileNameW

crypt32

CertAddCRLContextToStore CertAddCTLContextToStore CertAddCertificateContextToStore CertAddStoreToCollection CertCloseStore CertCreateCertificateChainEngine CertDeleteCertificateFromStore CertDuplicateCertificateContext CertEnumCRLsInStore CertEnumCTLsInStore CertEnumCertificatesInStore CertEnumSystemStore CertFindExtension CertFreeCRLContext CertFreeCTLContext CertFreeCertificateChain CertFreeCertificateChainEngine CertFreeCertificateContext CertGetCertificateChain CertGetCertificateContextProperty CertGetEnhancedKeyUsage CertGetNameStringW CertGetPublicKeyLength CertGetStoreProperty CertGetValidUsages CertNameToStrW CertOpenStore CertOpenSystemStoreW CertRDNValueToStrW CertSaveStore CertSetCertificateContextProperty CertSetEnhancedKeyUsage CryptBinaryToStringA CryptDecodeObjectEx CryptFindLocalizedName CryptFindOIDInfo CryptFormatObject CryptQueryObject PFXExportCertStore

gdi32

CreateFontW DeleteObject GetDeviceCaps

kernel32

CloseHandle CompareFileTime CreateFileW DelayLoadFailureHook DisableThreadLibraryCalls EnumResourceNamesW FileTimeToSystemTime FindResourceW FormatMessageW FreeLibrary GetDateFormatW GetEnvironmentVariableW GetLocaleInfoW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource LocalFree MulDiv MultiByteToWideChar RaiseException ResolveDelayLoadedAPI SizeofResource WriteFile lstrcmpW

ntdll

_vsnprintf

ole32

CreateBindCtx OleCreateDefaultHandler

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp calloc free fwrite getenv iswprint iswspace malloc memcmp memcpy memmove realloc strchr strcmp strcpy strcspn strlen wcslen wcsrchr

user32

DialogBoxParamW EnableWindow EndDialog EnumChildWindows GetClassLongW GetDC GetDlgItem GetParent GetWindowLongPtrW GetWindowRect IsDlgButtonChecked LoadBitmapW LoadImageW LoadStringW MapWindowPoints MessageBoxW PostMessageW ReleaseDC SendMessageA SendMessageW SetFocus SetWindowLongPtrW SetWindowPos ShowScrollBar ShowWindow

Name

.text

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

/63873

Size

4KB

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

888KB

Virtual Size

887KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4225607772b4a806f53b6a0aafb2b897d060714f7adbe1066b746093e317714f

advapi32

comctl32

comdlg32

crypt32

gdi32

kernel32

ntdll

ole32

ucrtbase

user32

generic