96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696

Sharing

Copy URL Twitter E-mail

General

Target
96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696
Size 991KB
Sample261002-e647raxzbw
SHA256 96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696
MD5 95a4a21541030d26e33644f1f8326161
SHA1 e321edab79827cb1b4b8f721dedd02a5b6599c93
SHA512 11eb4b386ea5d8c024f3235f7dd8e1ccb0746e6f35ecc1c08ce782a65ef5b51c006cf37f1d2a7783b812229820dacc6e456e74fea217873c38ea8fd023359190
SSDEEP 24576:nAFCu3nqMcKnzICM4i/M19FB8/dh+Eh4IbIRj:qn17F93yhIx
TLSH
T184257D16A96800FCD07BD2F8CAB39D12E772B84B03319AD717E199650F5B9E44E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696

File Explorer

96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696

.exe 991KB

96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696

IMPHASH 2d3f619a5d5f0bfe4ebcc215d0b1c0e6
SHA256 96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696
MD5 95a4a21541030d26e33644f1f8326161
SHA1 e321edab79827cb1b4b8f721dedd02a5b6599c93
SHA512 11eb4b386ea5d8c024f3235f7dd8e1ccb0746e6f35ecc1c08ce782a65ef5b51c006cf37f1d2a7783b812229820dacc6e456e74fea217873c38ea8fd023359190
SSDEEP 24576:nAFCu3nqMcKnzICM4i/M19FB8/dh+Eh4IbIRj:qn17F93yhIx
TLSH
T184257D16A96800FCD07BD2F8CAB39D12E772B84B03319AD717E199650F5B9E44E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

578452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Dev\tools\shittim-logon\installer\obj\config.pdb

user32

DispatchMessageW RegisterClassW PostQuitMessage CreateWindowExW IsWindow DestroyWindow ShowWindow SetWindowPos GetDoubleClickTime DefWindowProcW PostMessageW GetMessageTime TranslateMessage PeekMessageW IsIconic SetProcessDPIAware EnumDisplayMonitors GetMonitorInfoW GetMessageW TrackMouseEvent RegisterWindowMessageW wsprintfW RegisterClassExW WindowFromPoint MonitorFromWindow SystemParametersInfoW EnumDisplaySettingsW LoadImageW LoadIconW LoadCursorW GetLastActivePopup FindWindowW SetWindowLongPtrW GetWindowLongPtrW wsprintfA ScreenToClient GetCursorPos SetCursor MessageBoxW GetWindowRect GetClientRect ValidateRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow UpdateWindow TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture GetKeyState IsClipboardFormatAvailable EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsZoomed

gdi32

GetDeviceCaps

advapi32

OpenProcessToken CreateWellKnownSid EqualSid ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW ConvertSidToStringSidW SetSecurityInfo SetNamedSecurityInfoW GetSecurityInfo GetNamedSecurityInfoW SetEntriesInAclW RegGetValueW RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegCloseKey LookupPrivilegeValueW IsWellKnownSid IsValidSid GetTokenInformation GetSecurityDescriptorOwner GetSecurityDescriptorDacl GetAclInformation GetAce AdjustTokenPrivileges

shell32

ShellExecuteExW Shell_NotifyIconW CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath

ole32

PropVariantClear CoCreateInstance IIDFromString CoTaskMemFree CoUninitialize CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantInit

wtsapi32

WTSQueryUserToken

d2d1

ord1 ord2

dwrite

DWriteCreateFactory

dwmapi

DwmSetWindowAttribute

shlwapi

ord12

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

wevtapi

EvtExportLog

comdlg32

GetOpenFileNameW

kernel32

ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter RtlCaptureContext RtlVirtualUnwind LCMapStringW FindFirstFileExW IsValidCodePage GetACP IsDebuggerPresent GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW GetConsoleOutputCP HeapSize HeapReAlloc GetSystemInfo VirtualQuery SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimePreciseAsFileTime TryAcquireSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx Process32NextW Process32FirstW CreateToolhelp32Snapshot WriteConsoleW GetConsoleMode AttachConsole IsValidLocaleName GetLocaleInfoEx WideCharToMultiByte MultiByteToWideChar CompareStringOrdinal UnhandledExceptionFilter HeapFree GetDateFormatEx GetTimeFormatEx WTSGetActiveConsoleSessionId SystemTimeToFileTime CopyFileW QueryFullProcessImageNameW FileTimeToDosDateTime MulDiv HeapAlloc GetFileType GetOEMCP VirtualProtect LocalFree GlobalFree LoadLibraryExA GetFileInformationByHandle GetStdHandle GetCommandLineW GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FileTimeToLocalFileTime FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetDriveTypeW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime GetFullPathNameW GetTempFileNameW ReadFile RemoveDirectoryW SetEndOfFile SetFileInformationByHandle SetFilePointerEx WriteFile GetTempPathW CloseHandle GetLastError SetLastError QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared WaitForSingleObject OpenMutexW SetWaitableTimer CreateMutexExW CreateWaitableTimerExW Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess OpenProcess GetSystemTime GetLocalTime GetTickCount GetTickCount64 GetWindowsDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock

Name

.text

Size

700KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

96b291832fb605f51c0e1abb18b6b28a6e29cb27646a7f4e54c4192f3fd7d696

user32

gdi32

advapi32

shell32

ole32

oleaut32

wtsapi32

d2d1

dwrite

dwmapi

shlwapi

d3d11

dcomp

imm32

wevtapi

comdlg32

kernel32

generic