0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9

Sharing

Copy URL Twitter E-mail

General

Target
0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9
Size 639KB
Sample261003-s2mnss1gnf
SHA256 0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9
MD5 97b5c2359c2c8c3736575f4c42def88c
SHA1 d1ffc921402719ed103717acd3393d2eee69c989
SHA512 1b4be7247b8c6a5d12b1d192083a81a096e4a037cae8028052ce7232e17d0d40d61cfb66d3593d9538753813081079f8265f0bae6722a6cb0f64ed7db57f0787
SSDEEP 12288:PqOP/A69DNW7adheY6tsbvtia92PLcivzntYM6sjXiEXC9RqYi/nycitZZ:PqN6XqY9bewivzj6sDEri/nycc
TLSH
T129D4AE12F1F452ECD02BD239965BBA0BF735384907202ED723E455991FA3AE44BBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9

File Explorer

0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9

.dll 639KB

0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9

IMPHASH eb395f4df9e3bc261808689cae96e0ad
SHA256 0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9
MD5 97b5c2359c2c8c3736575f4c42def88c
SHA1 d1ffc921402719ed103717acd3393d2eee69c989
SHA512 1b4be7247b8c6a5d12b1d192083a81a096e4a037cae8028052ce7232e17d0d40d61cfb66d3593d9538753813081079f8265f0bae6722a6cb0f64ed7db57f0787
SSDEEP 12288:PqOP/A69DNW7adheY6tsbvtia92PLcivzntYM6sjXiEXC9RqYi/nycitZZ:PqN6XqY9bewivzj6sDEri/nycc
TLSH
T129D4AE12F1F452ECD02BD239965BBA0BF735384907202ED723E455991FA3AE44BBB712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

508288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData MessageBoxW DefWindowProcW CallWindowProcW DestroyWindow SetWindowLongPtrW CreateWindowExW UnregisterClassW RegisterClassExW

shell32

ShellExecuteW

kernel32

GetCurrentProcessId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable GetSystemTimeAsFileTime QueryPerformanceCounter FreeLibrary IsDBCSLeadByte QueryPerformanceFrequency InitializeSListHead LoadLibraryA GetLocaleInfoA DisableThreadLibraryCalls WritePrivateProfileStringW VirtualProtect GetPrivateProfileIntW GetModuleFileNameW WaitForSingleObject GetFileAttributesW GetPrivateProfileStringW CloseHandle CreateThread GetLocalTime GetWindowsDirectoryW GetModuleHandleW WideCharToMultiByte VirtualFree GetCurrentProcess VirtualAlloc Sleep GetTickCount64 VirtualQuery GetProcAddress ReadFile WriteFile CreateFileW MultiByteToWideChar FlushInstructionCache GetVolumeInformationW GetComputerNameW GlobalAlloc GlobalFree GlobalLock GlobalUnlock

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpOpen WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpReadData WinHttpQueryHeaders WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptGenRandom BCryptFinishHash

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyExW

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?good@ios_base@std@@QEBA_NXZ _Cnd_do_broadcast_at_thread_exit _Thrd_id _Thrd_join ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z _Xtime_get_ticks ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Mtx_unlock ?uncaught_exceptions@std@@YAHXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_type_info_destroy_list _CxxThrowException __current_exception_context __current_exception memset memmove memcpy memcmp memchr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vsscanf fread fseek __acrt_iob_func fwrite __stdio_common_vsnwprintf_s __stdio_common_vsprintf fclose __stdio_common_vswprintf_s _wfopen _wfopen_s fflush ftell fputws

api-ms-win-crt-convert-l1-1-0

wcstoul strtoll wcstod atof strtol

api-ms-win-crt-runtime-l1-1-0

_initterm_e _beginthreadex _initterm _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment terminate

api-ms-win-crt-string-l1-1-0

wcslen strncpy strncmp strcmp strlen isspace

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

acosf ceilf logf sinf fmodf sqrtf powf cosf

Sharing

General

Malware Config

Signatures

File Explorer

0a3d4fab4eef0b4deb23bd3a58d6de87d6b774db1bb152b0d576d578fbc8b6a9

user32

shell32

kernel32

d3d11

d3dcompiler_47

winhttp

bcrypt

advapi32

msvcp140

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

generic