76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94

Sharing

Copy URL Twitter E-mail

General

Target
76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94
Size 870KB
Sample261002-e65hhsvdrf
SHA256 76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94
MD5 7b57727ce4180d31f65a362702d2b78d
SHA1 efba9a264c0b60123c3cf9a3f5436aa3ec6c4bd8
SHA512 8d7bdb42413c5714364b8350188455579889110b66ae987b55f1bf5c7b2c0a451f692b719d3ab137732fe31bd3258edce5e0ada952179459e1af5673aab857f4
SSDEEP 24576:wMqEsUqDxBtxMB8TOb+EB/xtHecPa/BFsUhdpH:w5f3qHecPa/BHZH
TLSH
T156156E1696A801FDE0B7D2F8CA679C42E772B80B073199EB039159A53F279E44D3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94

File Explorer

76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94

.exe 870KB

76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94

IMPHASH 576ab7982dbdd7ca839f828559f2de49
SHA256 76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94
MD5 7b57727ce4180d31f65a362702d2b78d
SHA1 efba9a264c0b60123c3cf9a3f5436aa3ec6c4bd8
SHA512 8d7bdb42413c5714364b8350188455579889110b66ae987b55f1bf5c7b2c0a451f692b719d3ab137732fe31bd3258edce5e0ada952179459e1af5673aab857f4
SSDEEP 24576:wMqEsUqDxBtxMB8TOb+EB/xtHecPa/BFsUhdpH:w5f3qHecPa/BHZH
TLSH
T156156E1696A801FDE0B7D2F8CA679C42E772B80B073199EB039159A53F279E44D3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

455652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Dev\tools\shittim-logon\installer\obj\install.pdb

user32

SetWindowPos ShowWindow GetMessageTime PeekMessageW DispatchMessageW CreateWindowExW IsWindowVisible IsIconic IsZoomed OpenClipboard CloseClipboard SetClipboardData GetClipboardData RegisterClassExW GetDoubleClickTime PostQuitMessage DefWindowProcW PostMessageW TranslateMessage GetMessageW TrackMouseEvent GetWindowThreadProcessId EmptyClipboard SetProcessDPIAware EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow MonitorFromPoint EnumDisplaySettingsW LoadIconW LoadCursorW GetWindow wsprintfA EnumWindows SetWindowLongPtrW GetWindowLongPtrW WindowFromPoint ScreenToClient GetCursorPos SetCursor MessageBoxW GetWindowRect GetClientRect ValidateRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC UpdateWindow GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture GetKeyState IsClipboardFormatAvailable

gdi32

GetDeviceCaps

advapi32

GetAce OpenProcessToken AdjustTokenPrivileges CreateWellKnownSid EqualSid GetAclInformation GetSecurityDescriptorDacl GetSecurityDescriptorOwner ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW ConvertSidToStringSidW SetSecurityInfo SetNamedSecurityInfoW GetSecurityInfo GetNamedSecurityInfoW SetEntriesInAclW RegGetValueW RegDeleteTreeW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW IsWellKnownSid IsValidSid GetTokenInformation

shell32

CommandLineToArgvW ShellExecuteW SHGetKnownFolderPath

ole32

PropVariantClear CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

VariantInit SysAllocString SysFreeString VariantClear

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmSetWindowAttribute

bcrypt

BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider

shlwapi

ord12

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

kernel32

RtlCaptureContext ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileType HeapFree HeapAlloc VirtualProtect LCMapStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW ReadConsoleW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetConsoleOutputCP HeapSize Process32NextW Process32FirstW CreateToolhelp32Snapshot GetConsoleProcessList SetCurrentConsoleFontEx GetCurrentConsoleFontEx SetConsoleOutputCP WriteConsoleW GetConsoleMode AttachConsole WideCharToMultiByte MultiByteToWideChar WTSGetActiveConsoleSessionId ReplaceFileW MoveFileExW HeapReAlloc GetSystemInfo VirtualQuery LoadLibraryExA SetFileAttributesW GetStdHandle GetCommandLineW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx GetTempFileNameW ReadFile RemoveDirectoryW SetFileInformationByHandle SetFilePointer SetFilePointerEx WriteFile GetTempPathW CloseHandle SetHandleInformation GetLastError SetLastError CreatePipe QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateThread CreateProcessW ProcessIdToSessionId OpenProcess GetLocalTime GetTickCount GetTickCount64 CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock LocalFree MulDiv FormatMessageW lstrcpynW QueryFullProcessImageNameW CopyFileW

Name

.text

Size

608KB

Virtual Size

608KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

76dd89a15dbde2b71c79b58db3c2ad738d1050de7b7fadc26e25a6e0725b7d94

user32

gdi32

advapi32

shell32

ole32

oleaut32

d2d1

dwrite

dwmapi

bcrypt

shlwapi

d3d11

dcomp

imm32

kernel32

generic