0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19

Sharing

Copy URL Twitter E-mail

General

Target
0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19
Size 2.0MB
Sample261002-hmvezst12q
SHA256 0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19
MD5 b4daac3a28e519a65aab4609bcdeb18b
SHA1 ee9c80afc9d7840580305b2b7bcb8a9b11b2c184
SHA512 c490d7b6ad68bdff957d767e475b5567a7b04ddda951ec3de51cd91fdee105d972698bb57311f4f69eaeee483df70f5c10b6ec8a520b599dcd2a78b9ac038b32
SSDEEP 24576:3/b9ad13ujLVoXbpj2D/O1hRO5JTAKqIcjvr2aKngL2jdshRTdG1YxITqvfPkbIp:vw732D/eITAKqIcmarSj8RoTCCW
TLSH
T1A2A5E10178A190B0C8023172342DEB7E5E785F154B6589CBDBD0BDE4ABB52D11A3B7EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19

File Explorer

0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19

.exe 2.0MB

0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19

IMPHASH 8afa5cebd1386ac8c23e41646660f710
SHA256 0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19
MD5 b4daac3a28e519a65aab4609bcdeb18b
SHA1 ee9c80afc9d7840580305b2b7bcb8a9b11b2c184
SHA512 c490d7b6ad68bdff957d767e475b5567a7b04ddda951ec3de51cd91fdee105d972698bb57311f4f69eaeee483df70f5c10b6ec8a520b599dcd2a78b9ac038b32
SSDEEP 24576:3/b9ad13ujLVoXbpj2D/O1hRO5JTAKqIcjvr2aKngL2jdshRTdG1YxITqvfPkbIp:vw732D/eITAKqIcmarSj8RoTCCW
TLSH
T1A2A5E10178A190B0C8023172342DEB7E5E785F154B6589CBDBD0BDE4ABB52D11A3B7EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

626464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

tt_crash_reporter.exe.pdb

advapi32

CreateProcessAsUserW RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

dbghelp

MiniDumpReadDumpStream MiniDumpWriteDump SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW ord165 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

user32

AllowSetForegroundWindow CharUpperW GetActiveWindow MessageBoxW UnregisterClassW

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareFileTime CompareStringW CreateEventW CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadLocale GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsBadStringPtrA IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetPerformanceInfo LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoTaskMemFree

parfait

?AddCrashContext@ParfaitWrapperBase@parfait@@QAEXPBD0@Z ?InitGlobalEnv@ParfaitWrapperBase@parfait@@QAEXAAVParfaitGlobalEnvBuilderBase@2@@Z ?InitInstanceEnv@ParfaitWrapperBase@parfait@@QAEXAAVParfaitEnvBuilderBase@2@@Z ?SetAppVersion@ParfaitGlobalEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?SetChannel@ParfaitGlobalEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?SetDid@ParfaitGlobalEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?SetHost@ParfaitGlobalEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?SetIsDebug@ParfaitGlobalEnvBuilderBase@parfait@@SAX_N@Z ?SetProcessName@ParfaitEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?SetRootPathName@ParfaitGlobalEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?SetUid@ParfaitGlobalEnvBuilderBase@parfait@@QAEAAV12@PBD@Z ?UploadCrashFile@ParfaitWrapperBase@parfait@@QAEXPBUCrashUploadRequest@12@@Z ?UploadFile@ParfaitWrapperBase@parfait@@QAEXPBDPBUUploadFileCallback@12@@Z CreateParfaitEnvBuilder CreateParfaitGlobalEnvBuilder CreateParfaitWrapper DestroyParfaitEnvBuilder DestroyParfaitGlobalEnvBuilder DestroyParfaitWrapper

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWriteData

winmm

timeGetTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shlwapi

PathMatchSpecW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

249B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

792KB

Virtual Size

796KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0ffb9077f768c16b025183bf89a15893a4585adc1ec051689def31d8e266fe19

advapi32

dbghelp

shell32

user32

kernel32

ole32

parfait

winhttp

winmm

userenv

shlwapi

version

generic