92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83

Sharing

Copy URL Twitter E-mail

General

Target
92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83
Size 10.2MB
Sample261002-szsr2athrc
SHA256 92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83
MD5 b9ec7e9f686153d36c9edeac0135b83d
SHA1 f2624593506101654e4fe340815230a05a4ced33
SHA512 fe4e35306fa8667d93ceef2f5d96dc020214e53761a88ce0f1ed8009006a088a15412db1474c214bc4bc5aaf20e4190582b3760d1257cd76ce48209ee5ef783d
SSDEEP 196608:xGSqGnib5OkJ/cPPzfwu4iFvveRHZRpwyzPgl:xjTib5OkgzhFvGlZnwy
TLSH
T155B633B3915D0295E0D6D43BCA3BBDF532F6133E4B81A8B895D9DEC61B625E4C207A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83

File Explorer

92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83

.exe 10.2MB

92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83

IMPHASH be08764d0b136d376a4373774522034b
SHA256 92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83
MD5 b9ec7e9f686153d36c9edeac0135b83d
SHA1 f2624593506101654e4fe340815230a05a4ced33
SHA512 fe4e35306fa8667d93ceef2f5d96dc020214e53761a88ce0f1ed8009006a088a15412db1474c214bc4bc5aaf20e4190582b3760d1257cd76ce48209ee5ef783d
SSDEEP 196608:xGSqGnib5OkJ/cPPzfwu4iFvveRHZRpwyzPgl:xjTib5OkgzhFvGlZnwy
TLSH
T155B633B3915D0295E0D6D43BCA3BBDF532F6133E4B81A8B895D9DEC61B625E4C207A03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11313040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

iphlpapi

GetAdaptersInfo

winmm

midiStreamStop midiOutReset midiStreamRestart waveOutRestart midiStreamClose midiStreamOut midiOutPrepareHeader midiStreamProperty midiStreamOpen midiOutUnprepareHeader waveOutOpen waveOutGetNumDevs waveOutClose waveOutReset waveOutPause waveOutWrite waveOutPrepareHeader waveOutUnprepareHeader

ws2_32

accept WSACleanup closesocket inet_ntoa ntohl WSAAsyncSelect getpeername recv ioctlsocket recvfrom

kernel32

SetLastError QueryPerformanceFrequency QueryPerformanceCounter GetTimeZoneInformation GetVersion TerminateThread CreateMutexA ReleaseMutex SuspendThread InterlockedIncrement InterlockedDecrement GetWindowsDirectoryA GetSystemInfo IsProcessorFeaturePresent lstrcmpiA LocalFree FormatMessageA FileTimeToSystemTime FileTimeToLocalFileTime lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile GetThreadLocale GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA lstrcmpA LocalAlloc TlsAlloc GlobalHandle TlsFree TlsSetValue LocalReAlloc TlsGetValue GetFileTime GetCurrentThread GlobalFlags SetErrorMode GetProcessVersion GetCPInfo GetOEMCP GetStartupInfoA RtlUnwind GetSystemTime GetLocalTime RaiseException HeapSize GetACP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree SetEnvironmentVariableA LCMapStringA LCMapStringW VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW CompareStringA CompareStringW IsBadReadPtr IsBadCodePtr SetStdHandle TerminateProcess GetCurrentProcess GetFileSize SetFilePointer GetSystemDirectoryA GetTempFileNameA CreateSemaphoreA ResumeThread ReleaseSemaphore EnterCriticalSection LeaveCriticalSection GetProfileStringA WriteFile WaitForMultipleObjects CreateFileA DeviceIoControl SetEvent FindResourceA LoadResource LockResource ReadFile lstrlenW RemoveDirectoryA GetModuleFileNameA WideCharToMultiByte MultiByteToWideChar GetCurrentThreadId ExitProcess GlobalSize GlobalFree DeleteCriticalSection InitializeCriticalSection lstrcatA lstrlenA WinExec lstrcpyA FindNextFileA GetDriveTypeA GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetUserDefaultLCID GetFullPathNameA FreeLibrary LoadLibraryA GetLastError GetVersionExA WritePrivateProfileStringA GetPrivateProfileStringA CreateThread CreateEventA Sleep ExpandEnvironmentStringsA GlobalAlloc GlobalLock GlobalUnlock GetTempPathA FindFirstFileA FindClose SetFileAttributesA GetFileAttributesA DeleteFileA GetCurrentDirectoryA SetCurrentDirectoryA GetVolumeInformationA GetModuleHandleA GetProcAddress MulDiv GetCommandLineA GetTickCount CreateProcessA WaitForSingleObject CloseHandle InterlockedExchange VirtualQuery GetSystemTimeAsFileTime GetModuleHandleA CreateEventA GetModuleFileNameW LoadLibraryA TerminateProcess GetCurrentProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask GetCurrentThread SetThreadAffinityMask Sleep FreeLibrary GetTickCount SystemTimeToFileTime FileTimeToSystemTime GlobalFree LocalAlloc LocalFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetModuleHandleW LoadResource MultiByteToWideChar FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetCommandLineA RaiseException RtlUnwind HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount SetStdHandle LocalAlloc LocalFree GetModuleFileNameW GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep ExitProcess FreeLibrary LoadLibraryA GetModuleHandleA GetProcAddress

user32

GetMenuCheckMarkDimensions CharNextA SetWindowContextHelpId MapDialogRect LoadStringA GetSysColorBrush GetNextDlgGroupItem PostThreadMessageA IsDialogMessageA ScrollWindowEx SendDlgItemMessageA MapWindowPoints AdjustWindowRectEx ScrollWindow GetScrollInfo SetScrollInfo ShowScrollBar GetScrollPos RegisterClassA GetMenuItemCount GetMenuItemID CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetMessageTime GetLastActivePopup RegisterWindowMessageA GetWindowPlacement GetNextDlgTabItem EndDialog CreateDialogIndirectParamA DestroyWindow GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC CharUpperA GetWindowTextLengthA GetForegroundWindow GetWindowTextA GetDlgItem FindWindowA UnregisterClassA GetClassNameA GetDesktopWindow LoadIconA TranslateMessage DrawFrameControl DrawEdge DrawFocusRect WindowFromPoint GetMessageA DispatchMessageA SetRectEmpty RegisterClipboardFormatA CreateIconFromResourceEx GetMenuState DrawIconEx CreatePopupMenu AppendMenuA ModifyMenuA CreateMenu CreateAcceleratorTableA GetDlgCtrlID GetSubMenu EnableMenuItem ClientToScreen EnumDisplaySettingsA LoadImageA SystemParametersInfoA ShowWindow IsWindowEnabled TranslateAcceleratorA GetKeyState CopyAcceleratorTableA PostQuitMessage IsZoomed GetClassInfoA DefWindowProcA GetSystemMenu DeleteMenu GetMenu SetMenu PeekMessageA IsIconic SetFocus GetActiveWindow GetWindow DestroyAcceleratorTable SetWindowRgn GetMessagePos ScreenToClient ChildWindowFromPointEx CopyRect LoadBitmapA WinHelpA KillTimer SetTimer ReleaseCapture GetCapture SetCapture SetScrollRange SetScrollPos SetRect InflateRect IntersectRect DestroyIcon PtInRect OffsetRect IsWindowVisible EnableWindow RedrawWindow GetWindowLongA SetWindowLongA GetSysColor SetActiveWindow SetCursorPos LoadCursorA SetCursor GetDC FillRect IsRectEmpty ReleaseDC IsChild TrackPopupMenu DestroyMenu SetForegroundWindow GetWindowRect EqualRect UpdateWindow ValidateRect InvalidateRect GetClientRect GetFocus GetParent GetTopWindow PostMessageA IsWindow SetParent DestroyCursor SendMessageA SetWindowPos MessageBeep MessageBoxA GetCursorPos GetSystemMetrics EmptyClipboard SetClipboardData OpenClipboard GetClipboardData CloseClipboard wsprintfA WaitForInputIdle SetMenuItemBitmaps CheckMenuItem MoveWindow CreateIconFromResource SetWindowTextA GetScrollRange GetProcessWindowStation GetUserObjectInformationW CharUpperBuffW MessageBoxW GetProcessWindowStation GetUserObjectInformationW

gdi32

CreateRectRgn CombineRgn PatBlt CreatePen SelectObject CreateBitmap CreateDCA CreateCompatibleBitmap GetPolyFillMode GetStretchBltMode GetROP2 GetBkColor GetBkMode GetTextColor CreateRoundRectRgn CreateEllipticRgn SaveDC RestoreDC SetBkMode SetPolyFillMode SetROP2 SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx GetClipBox ExcludeClipRect FillRgn MoveToEx LineTo CreateSolidBrush ExtSelectClipRgn GetViewportExtEx PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextMetricsA GetMapMode CreateRectRgnIndirect SetStretchBltMode GetClipRgn CreatePolygonRgn SelectClipRgn DeleteObject CreateDIBitmap GetSystemPaletteEntries CreatePalette StretchBlt SelectPalette RealizePalette GetDIBits GetWindowExtEx GetViewportOrgEx GetWindowOrgEx BeginPath EndPath PathToRegion CreateFontIndirectA GetStockObject GetObjectA EndPage EndDoc DeleteDC StartDocA StartPage BitBlt CreateCompatibleDC Ellipse Rectangle LPtoDP DPtoLP GetCurrentObject RoundRect GetTextExtentPoint32A GetDeviceCaps SetBkColor

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA ChooseColorA

advapi32

RegCreateKeyExA RegOpenKeyA RegQueryValueA RegSetValueExA RegOpenKeyExA RegQueryValueExA RegCloseKey

shell32

ShellExecuteA Shell_NotifyIconA SHGetSpecialFolderPathA SHEmptyRecycleBinA

ole32

CoRevokeClassObject CoRegisterMessageFilter CoFreeUnusedLibraries CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes OleFlushClipboard CoDisconnectObject OleIsCurrentClipboard CoGetClassObject CoTaskMemFree CoTaskMemAlloc CLSIDFromProgID OleInitialize OleUninitialize CLSIDFromString CoCreateInstance OleRun

oleaut32

SafeArrayGetDim SafeArrayGetLBound SafeArrayUnaccessData VariantChangeType VariantClear VariantCopy SafeArrayAccessData SafeArrayGetElement VariantCopyInd VariantInit SafeArrayGetUBound VariantTimeToSystemTime SysStringLen SysAllocString SafeArrayDestroy SafeArrayCreate SafeArrayPutElement RegisterTypeLi LHashValOfNameSys LoadTypeLi OleCreateFontIndirect UnRegisterTypeLi SysAllocStringLen SafeArrayGetElemsize SysAllocStringByteLen SysFreeString

comctl32

ImageList_Duplicate ImageList_Read ImageList_Destroy ord17 ImageList_SetBkColor ImageList_GetImageCount

oledlg

ord8

wininet

FindNextUrlCacheEntryA FindFirstUrlCacheEntryA DeleteUrlCacheEntry

wtsapi32

WTSSendMessageW

Name

.text

Size

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

443KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.svmp0

Size

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.svmp1

Size

10.2MB

Virtual Size

10.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

92caf0d392b7e844492a9791dc508f9e909413818ecd8bb8a06db8680601bd83

iphlpapi

winmm

ws2_32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

oledlg

wininet

wtsapi32

generic