0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc

Sharing

Copy URL Twitter E-mail

General

Target
0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc
Size 716KB
Sample261003-r586jaswft
SHA256 0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc
MD5 00309158a8b404f998dc935cd6b7da62
SHA1 56823ae0f282c2893189ac7ac1e14b6115ae1479
SHA512 239d072e4dab2619f800b98825177ce5de683ef725775b86966a0614228793e662c1c95bf0cd7de3de495118b168daf6216f68a6bba2c16a5248adfbca95a854
SSDEEP 6144:w3X1YcUgqKcyjYrgx+grl9N5VuWUWWFUWT+OyNNYOlZCKbKI4jmdTwcEa1UXTdRh:C4yjYrW3b
TLSH
T1BDF4FA406BE9EF01F7FFDA3458796ED1482EBC829E32853EF63DB10947396508A58316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc

File Explorer

0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc

.dll 716KB

0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc

IMPHASH 805b425e4f2e44b7eab092c3edfd6625
SHA256 0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc
MD5 00309158a8b404f998dc935cd6b7da62
SHA1 56823ae0f282c2893189ac7ac1e14b6115ae1479
SHA512 239d072e4dab2619f800b98825177ce5de683ef725775b86966a0614228793e662c1c95bf0cd7de3de495118b168daf6216f68a6bba2c16a5248adfbca95a854
SSDEEP 6144:w3X1YcUgqKcyjYrgx+grl9N5VuWUWWFUWT+OyNNYOlZCKbKI4jmdTwcEa1UXTdRh:C4yjYrW3b
TLSH
T1BDF4FA406BE9EF01F7FFDA3458796ED1482EBC829E32853EF63DB10947396508A58316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ntdll

DbgPrint NtPowerInformation NtQueryInformationToken NtShutdownSystem RtlAdjustPrivilege RtlAllocateAndInitializeSid RtlAllocateHeap RtlAssert RtlEqualSid RtlFreeHeap RtlFreeSid RtlInitAnsiString RtlInitUnicodeString vDbgPrintExWithPrefix

advapi32

AllocateLocallyUniqueId CreateProcessAsUserW DuplicateTokenEx GetTokenInformation GetUserNameW ImpersonateLoggedOnUser LsaClose LsaFreeMemory LsaOpenPolicy LsaRetrievePrivateData OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegOpenCurrentUser RegOpenKeyExW RegQueryValueExW RegSetValueExW RevertToSelf

kernel32

AllocConsole CloseHandle CreateEventW CreateSemaphoreW CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FlushConsoleInputBuffer FreeLibrary GetComputerNameW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentVariableA GetLastError GetLocalTime GetModuleHandleA GetModuleHandleExW GetProcAddress GetProcessHeap GetStdHandle GetSystemTimeAsFileTime GetTickCount GetTimeFormatW GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LocalReAlloc MulDiv QueryPerformanceCounter RaiseException ReadConsoleW ReleaseSemaphore RtlUnwind SetConsoleMode SetEvent SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW

msvcrt

__dllonexit _amsg_exit _initterm _iob _lock _onexit _snprintf _unlock _vsnprintf _vsnwprintf _wcsicmp abort bsearch calloc free fwrite malloc memcmp memmove sprintf strchr strcmp strcpy strcspn strncmp vfprintf wcscat wcschr wcscmp wcscpy wcslen wcstoul

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetObjectW GetStockObject SelectObject SetBkMode SetDIBits SetTextColor

user32

AdjustWindowRectEx BeginPaint CallWindowProcW ClientToScreen CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EnableWindow EndDialog EndPaint GetCapture GetClientRect GetDC GetDesktopWindow GetDlgCtrlID GetDlgItem GetDlgItemTextW GetKeyState GetParent GetSystemMetrics GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InvalidateRect IsWindow IsWindowVisible KillTimer LoadBitmapW LoadCursorW LoadImageW LoadStringW MapWindowPoints MessageBoxW MoveWindow PeekMessageW PostMessageW RegisterClassExW ReleaseCapture ReleaseDC SendDlgItemMessageW SendMessageW SetCapture SetCursor SetDlgItemTextW SetFocus SetForegroundWindow SetRect SetThreadDesktop SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow TranslateMessage UnregisterClassW UpdateWindow WindowFromPoint wsprintfW

Name

.text

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

ATL

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

529KB

Virtual Size

528KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rossym

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0444458c7bd54d59dd4e25fdddce86e258dc6ae3dc5b052ccc72d5400107a0cc

ntdll

advapi32

kernel32

msvcrt

gdi32

user32

generic