file3_unsafe

Sharing

Copy URL Twitter E-mail

General

Target
file3_unsafe
Size 39KB
Sample261003-rja2lsdf58
SHA256 7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850
MD5 dd600093d8a167e361a7d0160d676391
SHA1 373f7eb97c0ff494899b4ee9627cc0d4e0bf1d35
SHA512 23e8780adcc213cf87ae2b7746c01d33b5b7295a9d45801db8a04f2dbacbe4e027c89e3ed8842c782d4cf781c6f723d580edd13b486b67be17314eb7341c44be
SSDEEP 768:wHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ3CRfJSWZfbo:wpgpHzb9dZVX9fHMvG0D3XJ3CRfJ1fbo
TLSH
T1F703B01FB6C099FBD5D246710677F77AF7BBC6C4026219074B682F7E3E615838909282
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
file3_unsafe
unpack001/$_37_/ddnow.exe
unpack001/$_37_/ddnow4.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

file3_unsafe

.exe 39KB
$_37_/ddnow.exe

.exe 6KB
$_37_/ddnow4.exe

.exe 6KB

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 7aa9127853d3bd2095db9dfc2475a2f74246ea83e7d4ce8519b9c04a02749850
MD5 dd600093d8a167e361a7d0160d676391
SHA1 373f7eb97c0ff494899b4ee9627cc0d4e0bf1d35
SHA512 23e8780adcc213cf87ae2b7746c01d33b5b7295a9d45801db8a04f2dbacbe4e027c89e3ed8842c782d4cf781c6f723d580edd13b486b67be17314eb7341c44be
SSDEEP 768:wHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ3CRfJSWZfbo:wpgpHzb9dZVX9fHMvG0D3XJ3CRfJ1fbo
TLSH
T1F703B01FB6C099FBD5D246710677F77AF7BBC6C4026219074B682F7E3E615838909282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$_37_/ddnow.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b6e08bfe80854efa5327edf08743c6039f4212527082210f4bc5c96642889e43
MD5 021c21578c1d021c95b6608ca10f58eb
SHA1 ee66a3c2a446a4c5d5f023ead3fdfc9630918215
SHA512 9a00f20ffc4cafbf40f5cfd653f3a38ddba65b4f466d80e438e26286615b1645f924d069633e462cf786fd9a3d7408d9892308e88e746388c47f8f5e40c2b887
SSDEEP 48:6Qdowd+bmkwlB7WcPSCffDtZ/TmaqKbWuJtiQfa7Zl0ZXiVOVU1mWSWw2i2q9lac:Nxd+bmP51tLfa7DwyVOVymWSWa9szNt
TLSH
T1A4D1B600BBE89736D97F0F359CA363104A79F3526E475F5E24DC022B9E436244E63AB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Administrator\Desktop\pelvis\pelvis\obj\Release\foibles.pdb

$_37_/ddnow4.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2e57a40dfed94791e6bfe24e6a4fc79d227c375bda1ed3f2efa6873750b91396
MD5 52d2a0567b3cede5149a6cef5fa41424
SHA1 76977384d71669e0f53fa1dafe3abbc80a889758
SHA512 34d0069262a476e253fa0d675d62a871a5a8f2c53736712f6fe4eda5e8392a9a548bac56042204a6b2782a9dd97b67836294915193eac5e22503e7e8f6fb34ee
SSDEEP 96:BJ06y5x14iXx/awJyVO+NTfygS//gKEKMK5U9KdoKIzNt:j0T9awIOSTXS/4hZ99gor
TLSH
T13FC1C810A7C8173AD97B07396CA3A79092B5F7318C47CE5E34CC411E9F127288DA2BB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Administrator\Desktop\nitrocellulose\nitrocellulose\obj\Release\winningly.pdb

file3_unsafe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$_37_/ddnow.exe

mscoree

dotnet

$_37_/ddnow4.exe

mscoree

dotnet