8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce

Sharing

Copy URL Twitter E-mail

General

Target
8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce
Size 2.0MB
Sample261002-lxp5ssysav
SHA256 8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce
MD5 e1f2a54664cc9d30228af914be5047a5
SHA1 94979a5eb8f4f5f10eeeeb7bf647fe5426c37015
SHA512 01582885384975da2bbe1c6345faa1db33798c87889de8bde6272c0a1871a5f053ae94f797eee01752b573033dab7c840078a5c7d9dfeb4eb63f0f96df519a35
SSDEEP 49152:4WbP2SSlFxWmXaMr8hflYks2tdarSj8RoTCCW:4e2SkMOaMr8RlYksOJTy
TLSH
T1A095CF05F542A074C8473236711DEB2D6A285E068F258DDBC7E4BCF86EB25C316366AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce

File Explorer

8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce

.exe 2.0MB

8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce

IMPHASH b43c09b6dda66698410d874fd47ad893
SHA256 8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce
MD5 e1f2a54664cc9d30228af914be5047a5
SHA1 94979a5eb8f4f5f10eeeeb7bf647fe5426c37015
SHA512 01582885384975da2bbe1c6345faa1db33798c87889de8bde6272c0a1871a5f053ae94f797eee01752b573033dab7c840078a5c7d9dfeb4eb63f0f96df519a35
SSDEEP 49152:4WbP2SSlFxWmXaMr8hflYks2tdarSj8RoTCCW:4e2SkMOaMr8RlYksOJTy
TLSH
T1A095CF05F542A074C8473236711DEB2D6A285E068F258DDBC7E4BCF86EB25C316366AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

925056

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

app_doctor.exe.pdb

imm32

ImmDisableIME

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

advapi32

CreateProcessAsUserW DuplicateToken EventRegister EventUnregister EventWrite GetTokenInformation OpenProcessToken RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

shlwapi

PathFileExistsW PathMatchSpecW StrStrW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EndDialog GetActiveWindow GetQueueStatus GetWindowLongW KillTimer LoadIconW LoadStringW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SendMessageW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos TranslateMessage UnregisterClassW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler AssignProcessToJobObject CallbackMayRunLong CloseHandle CloseThreadpool CloseThreadpoolWork CompareStringW CopyFileW CreateEventW CreateFileA CreateFileW CreateIoCompletionPort CreateMutexW CreateProcessW CreateThread CreateThreadpool CreateThreadpoolWork CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetPerformanceInfo LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SubmitThreadpoolWork TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WaitForThreadpoolWorkCallbacks WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

ole32

CLSIDFromString CoCreateInstance CoInitialize CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemFree CoUninitialize IIDFromString

comctl32

ord345

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.voltbl

Size

512B

Virtual Size

182B

Characteristics

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

796KB

Virtual Size

796KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8cd91d917d2fac2f53022487b97c8f0ccbd2fcd28aa61be67427e9be256710ce

imm32

winhttp

advapi32

dbghelp

oleaut32

shell32

shlwapi

user32

winmm

kernel32

ole32

comctl32

netapi32

iphlpapi

userenv

generic