c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e

Sharing

Copy URL Twitter E-mail

General

Target
c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e
Size 1.0MB
Sample261001-mpnsfay1ev
SHA256 c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e
MD5 32b28a56b5ef7d2764857dcbf8fe201a
SHA1 d85fe2d53a39498c233f8223de0a437e9e8c9e68
SHA512 639c72ede245c949b84f26e8e2bdc119ca3539212287a9b7794f9e42ea5b5ebfd671969f157c703de053a357688f658f937b07ac024e4d84b3041e5af53ba6e7
SSDEEP 24576:h+FM6BeZnRRMuFehR2f+Jp0f/FybiWjFhiVY3vHaDmB7uq/:hWTh5nMF0hsVYSiZuq
TLSH
T1C7350183765140F6C83716B454B3DB3EFEB45A4189788E87C798E8696C22D353A3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e

File Explorer

c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e

.dll 1.0MB

c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e

IMPHASH 1ff0b78964e1ef5a185b957ab7be4bd9
SHA256 c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e
MD5 32b28a56b5ef7d2764857dcbf8fe201a
SHA1 d85fe2d53a39498c233f8223de0a437e9e8c9e68
SHA512 639c72ede245c949b84f26e8e2bdc119ca3539212287a9b7794f9e42ea5b5ebfd671969f157c703de053a357688f658f937b07ac024e4d84b3041e5af53ba6e7
SSDEEP 24576:h+FM6BeZnRRMuFehR2f+Jp0f/FybiWjFhiVY3vHaDmB7uq/:hWTh5nMF0hsVYSiZuq
TLSH
T1C7350183765140F6C83716B454B3DB3EFEB45A4189788E87C798E8696C22D353A3E38D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA WideCharToMultiByte GetUserDefaultLCID GetCurrentDirectoryA SetCurrentDirectoryA Sleep ReadFile GetFileSize GetTickCount SetFilePointer RtlMoveMemory WritePrivateProfileStringA GetLocalTime FreeLibrary GetProcAddress LoadLibraryA LCMapStringA GetPrivateProfileStringA CreateFileA WriteFile IsBadReadPtr HeapFree MultiByteToWideChar HeapReAlloc HeapAlloc ExitProcess GetModuleHandleA GetProcessHeap VirtualAlloc GetCurrentProcess VirtualFree IsWow64Process lstrcpyA lstrcatA MulDiv LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection CreateThread Process32Next GlobalMemoryStatusEx OpenProcess SetEndOfFile Process32First CreateToolhelp32Snapshot GetCommandLineA CreateNamedPipeA SetWaitableTimer CreateWaitableTimerA ResumeThread SetThreadContext WriteProcessMemory GetThreadContext TerminateProcess VirtualAllocEx WTSGetActiveConsoleSessionId CreateProcessA ExpandEnvironmentStringsA GetModuleFileNameA GetComputerNameA FindClose FindFirstFileA CloseHandle WaitForSingleObject GetStartupInfoA ProcessIdToSessionId MoveFileA GetCurrentProcessId

user32

GetCursorPos CreateWindowExA GetDC GetSysColor SetWindowsHookExA MsgWaitForMultipleObjects CallWindowProcA PeekMessageA GetMessageA GetForegroundWindow FindWindowA GetWindowTextA GetWindow GetClassNameA GetLastInputInfo GetWindowTextLengthA ExitWindowsEx DialogBoxIndirectParamA EndDialog CallNextHookEx GetKeyState MessageBoxA TranslateMessage DispatchMessageA UnregisterHotKey SetWindowLongA SetCapture SendMessageA ScreenToClient ReleaseCapture RegisterHotKey LoadBitmapA wsprintfA

shell32

DragAcceptFiles DragFinish DragQueryFileA SHGetFolderPathA SHCreateDirectoryExA SHGetSpecialFolderPathA

gdi32

CreateFontA DeleteObject GetDeviceCaps TranslateCharsetInfo

ws2_32

gethostbyname WSACleanup gethostname sendto recvfrom htonl inet_addr connect ntohs getpeername send recv select WSAIoctl setsockopt inet_ntoa WSAStartup getsockname __WSAFDIsSet listen closesocket bind htons socket accept

advapi32

CreateServiceA OpenSCManagerA CryptDecrypt CryptDestroyKey CryptSetKeyParam CryptReleaseContext CryptImportKey CryptAcquireContextW CreateProcessAsUserA SetTokenInformation DuplicateTokenEx OpenProcessToken OpenServiceA DeleteService GetTokenInformation AdjustTokenPrivileges RegEnumKeyA RegCloseKey RegOpenKeyExA RegQueryValueExA LookupPrivilegeValueA RegOpenKeyA RegSetValueExA RegCreateKeyExA CloseServiceHandle

ole32

CLSIDFromProgID CLSIDFromString OleRun CoUninitialize CoInitialize CoCreateInstance

oleaut32

SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim VariantInit VariantCopy SafeArrayDestroy VariantClear SysAllocString SafeArrayCreate RegisterTypeLi LHashValOfNameSys LoadTypeLi VariantChangeType VarR8FromBool VarR8FromCy SafeArrayGetElemsize SafeArrayUnaccessData

wininet

InternetCloseHandle InternetOpenA HttpOpenRequestA InternetReadFile HttpSendRequestA InternetSetOptionA InternetConnectA

shlwapi

PathIsDirectoryA PathFileExistsA

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpConnect WinHttpReceiveResponse

msvcrt

tolower toupper vsprintf calloc __dllonexit _onexit strncmp memmove realloc rand srand strncpy _CIfmod atoi __CxxFrameHandler malloc free strrchr strchr ??2@YAPAXI@Z ??3@YAXPAX@Z sprintf _ftol floor modf

comctl32

ord17 ImageList_EndDrag ImageList_DragShowNolock ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove

Name

.text

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

760KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c474265b6a3ceb5462a03da884313f5a98858957b7fea4fc45dcb06257cafe2e

kernel32

user32

shell32

gdi32

ws2_32

advapi32

ole32

oleaut32

wininet

shlwapi

wtsapi32

userenv

winhttp

msvcrt

comctl32

generic