f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644

Sharing

Copy URL Twitter E-mail

General

Target
f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644
Size 1.3MB
Sample261001-ldmwbssfnc
SHA256 f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644
MD5 4bfa2c1b2c98fccccdacc3ccbf581a67
SHA1 4bc8c1cf3a29966f7206afb7ead8d0e00cf8c079
SHA512 2fa63be5518536e78bf20459c066940f8318cccfacf1e1ab2efd51c115801a70d5d0ff788d4ae05bf5636ef356aca9fc86bb0ced4ccc33005c3f086f40931207
SSDEEP 12288:Vk/9KwJmoGv4KsrTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VY9KVoGQ1rrdCN/j2GLl3iFSE33b9
TLSH
T15D55F150B991C036D96705368AF8DFB9553DBEB08F6198C7A3C01FEBCA70AC09735626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644

File Explorer

f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644

.exe 1.3MB

f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644

IMPHASH e76f479fe1cad96988a6588ff0dcfa8e
SHA256 f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644
MD5 4bfa2c1b2c98fccccdacc3ccbf581a67
SHA1 4bc8c1cf3a29966f7206afb7ead8d0e00cf8c079
SHA512 2fa63be5518536e78bf20459c066940f8318cccfacf1e1ab2efd51c115801a70d5d0ff788d4ae05bf5636ef356aca9fc86bb0ced4ccc33005c3f086f40931207
SSDEEP 12288:Vk/9KwJmoGv4KsrTJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:VY9KVoGQ1rrdCN/j2GLl3iFSE33b9
TLSH
T15D55F150B991C036D96705368AF8DFB9553DBEB08F6198C7A3C01FEBCA70AC09735626
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50490

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\xd_gitlab\popplugin\PopPlugin\Output\bin\Release\Win32\SpeedUp.pdb

kernel32

LCMapStringEx LocalFree OutputDebugStringW LocalAlloc SetLastError LoadLibraryExW lstrcmpiW FreeLibrary GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc FindResourceW LoadResource FindResourceExW LoadLibraryW RaiseException CloseHandle HeapReAlloc LockResource GetLastError MultiByteToWideChar HeapSize GetCurrentThreadId InitializeCriticalSectionEx CreateMutexW LeaveCriticalSection GetModuleFileNameW GetPrivateProfileIntW EnterCriticalSection HeapFree SizeofResource WriteConsoleW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetVersionExW GetSystemInfo WideCharToMultiByte ReadFile GetStartupInfoW DeleteFileW CreateFileW WriteFile GetFileSizeEx FindNextFileW FindClose TerminateProcess GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo

user32

CharNextW GetWindowLongW CallWindowProcW RegisterClassExW IsWindow SetTimer LoadCursorW SetWindowLongW KillTimer GetClassInfoExW GetMessageW DefWindowProcW DestroyWindow UnregisterClassW DispatchMessageW PeekMessageW CreateWindowExW TranslateMessage

advapi32

RegOpenKeyExW QueryServiceStatus CloseServiceHandle OpenSCManagerW StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegSetValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteW SHCreateDirectoryExW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoUninitialize CoInitialize CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW PathRemoveFileSpecW PathFileExistsW PathCombineW SHGetValueW PathAppendW PathIsDirectoryW

comctl32

InitCommonControlsEx

Name

.text

Size

167KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

f9435477b128ad9386ae25c0b67b117f0b38efdfa8d38a2f396195f87a0d8644

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic