9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134

Sharing

Copy URL Twitter E-mail

General

Target
9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134
Size 1.7MB
Sample261002-helg4sbb99
SHA256 9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134
MD5 4e8bc9d5b8bbf52322d61fe6aa3c1331
SHA1 2b06e330bdb6988592b2ce689f4aca4f5cfeb846
SHA512 100eb011def21c81d12cde98e7f13f30f44fa1693bc41cf8c220e203798d7d878df6fe2606e282f55d525ef58c3b152a98a49799b054588f9c8aebaca0c4e39e
SSDEEP 49152:czUJZmPIk8x77AAH+Ove16uWWe/FTbWx:cAPbkk1+gDuW9/FTyx
TLSH
T110851200B881D472D1B314744BBDE772193DB8301B6955DBB3E82E7E8EB41C17A367AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134

File Explorer

9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134

.exe 1.7MB

9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134

IMPHASH 7a51b72b2a6e97ac4dd2a61c38773e2a
SHA256 9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134
MD5 4e8bc9d5b8bbf52322d61fe6aa3c1331
SHA1 2b06e330bdb6988592b2ce689f4aca4f5cfeb846
SHA512 100eb011def21c81d12cde98e7f13f30f44fa1693bc41cf8c220e203798d7d878df6fe2606e282f55d525ef58c3b152a98a49799b054588f9c8aebaca0c4e39e
SSDEEP 49152:czUJZmPIk8x77AAH+Ove16uWWe/FTbWx:cAPbkk1+gDuW9/FTyx
TLSH
T110851200B881D472D1B314744BBDE772193DB8301B6955DBB3E82E7E8EB41C17A367AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

123682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTempPathA FindNextFileW FindClose GetLastError OpenThread TerminateThread CloseHandle SetLastError InitializeCriticalSectionEx CreateThread DecodePointer FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetCommandLineW CreateMutexW WriteConsoleW CreateFileW FlushFileBuffers SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetTimeZoneInformation HeapSize GetConsoleMode GetConsoleCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetSystemDefaultLangID GetDateFormatW GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess HeapReAlloc ReadFile RtlUnwind GetCurrentProcessId WideCharToMultiByte lstrlenW MultiByteToWideChar GetUserDefaultUILanguage OutputDebugStringA GetCurrentThreadId RaiseException GetCurrentProcess DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetTempPathW GetLocalTime InitializeCriticalSection QueryPerformanceCounter GetStartupInfoW WaitForSingleObjectEx ResetEvent SetEvent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualFree VirtualAlloc IsProcessorFeaturePresent FlushInstructionCache Sleep SystemTimeToFileTime InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead GetProcessHeap HeapFree HeapAlloc OutputDebugStringW IsDebuggerPresent SetEndOfFile GetCPInfo GetStringTypeW GetLocaleInfoW LCMapStringW CompareStringW GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc CreateEventW InitializeCriticalSectionAndSpinCount EncodePointer GetTimeFormatW GetSystemTime

user32

KillTimer PostQuitMessage ShowWindow MessageBoxW MessageBoxTimeoutW IsWindowVisible DestroyWindow UnregisterClassW CreateDialogParamW SetWindowLongW CharNextW DispatchMessageW TranslateMessage wvsprintfW IsDialogMessageW RegisterDeviceNotificationW PostMessageW SetWindowTextW SendMessageW GetDlgItem EnableWindow SetWindowPos MapWindowPoints GetClientRect GetMessageW PeekMessageW FindWindowW GetParent GetWindowRect GetMonitorInfoW MonitorFromWindow GetWindowLongW GetWindow LoadImageW SetTimer UnregisterDeviceNotification DefWindowProcW GetSystemMetrics

advapi32

RegQueryInfoKeyW LookupPrivilegeValueW AdjustTokenPrivileges RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyExW OpenProcessToken RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey InitiateSystemShutdownW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

libwdi

wdi_register_logger wdi_destroy_list wdi_install_driver wdi_get_vendor_name wdi_create_list wdi_is_driver_supported _wdi_create_lockdown@0 wdi_set_log_level wdi_prepare_driver wdi_unregister_logger wdi_read_logger

winmm

timeGetTime

setupapi

SetupUninstallOEMInfW SetupDiRemoveDevice SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupGetInfDriverStoreLocationW SetupGetInfPublishedNameW SetupDiDestroyDeviceInfoList CM_Locate_DevNodeW CM_Reenumerate_DevNode SetupDiGetDeviceInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiBuildDriverInfoList SetupDiEnumDriverInfoW SetupDiOpenDevRegKey SetupDiGetDeviceRegistryPropertyW SetupDiGetDriverInfoDetailW SetupDiDestroyDriverInfoList

iphlpapi

GetAdaptersInfo

ws2_32

closesocket setsockopt socket connect ntohs inet_ntoa gethostbyname inet_addr htons htonl bind getsockname recv WSACleanup WSAStartup send

Name

.text

Size

266KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

560B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

9c51eb2494e860ae0277a0bd07c9e28bc581d4c6f5980ee9afee8d4168f03134

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

libwdi

winmm

setupapi

iphlpapi

ws2_32

generic