7WZ5e37Gka9w1q290601ONqR677ziM15[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
7WZ5e37Gka9w1q290601ONqR677ziM15.exe
Size 3.2MB
Sample261003-xljdnavfle
SHA256 a37de0b277b39580de4296931ce58013cc2646318c2912f262169c95ab11e4b9
MD5 3fe2904a4f383cbfd899a32d90219a54
SHA1 9371b106a0cf9500c0b04bd7800b90eb0e8486a9
SHA512 4bb2f09c9ca0016bd429e13f146e7163359a97a2f99aa51297310bd79ba0862897ee646189b71e765a3ab487ea9c15d36fce47a845b25b084325d6031e939f61
SSDEEP 49152:DnDaOEb1CSqE7dADSfTlF1QoTQ64zxQzYauF9Euh:zMWJS/1QoZ4cYZCuh
TLSH
T1CBF56D2372C4613EE06B1E7A5877D674587B7AB02A268C47EBF40A5C4F3D7802D3A647
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7WZ5e37Gka9w1q290601ONqR677ziM15.exe

File Explorer

7WZ5e37Gka9w1q290601ONqR677ziM15.exe

.exe 3.2MB

7WZ5e37Gka9w1q290601ONqR677ziM15.exe

IMPHASH c0a4f86ec74844cd9cb4ea7e4cc1cb1a
SHA256 a37de0b277b39580de4296931ce58013cc2646318c2912f262169c95ab11e4b9
MD5 3fe2904a4f383cbfd899a32d90219a54
SHA1 9371b106a0cf9500c0b04bd7800b90eb0e8486a9
SHA512 4bb2f09c9ca0016bd429e13f146e7163359a97a2f99aa51297310bd79ba0862897ee646189b71e765a3ab487ea9c15d36fce47a845b25b084325d6031e939f61
SSDEEP 49152:DnDaOEb1CSqE7dADSfTlF1QoTQ64zxQzYauF9Euh:zMWJS/1QoZ4cYZCuh
TLSH
T1CBF56D2372C4613EE06B1E7A5877D674587B7AB02A268C47EBF40A5C4F3D7802D3A647
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2795420

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW GetDefaultPrinterW EnumPrintersW

comctl32

ImageList_GetImageInfo FlatSB_SetScrollInfo ImageList_DragMove ImageList_Destroy _TrackMouseEvent ImageList_DragShowNolock ImageList_Add FlatSB_SetScrollProp ImageList_GetDragImage ImageList_Create ImageList_EndDrag ImageList_DrawEx ImageList_SetImageCount FlatSB_GetScrollPos FlatSB_SetScrollPos InitializeFlatSB ImageList_Copy FlatSB_GetScrollInfo ImageList_Write ImageList_DrawIndirect ImageList_SetBkColor ImageList_GetBkColor ImageList_BeginDrag ImageList_GetIcon ImageList_Replace ImageList_GetImageCount ImageList_DragEnter ImageList_GetIconSize ImageList_SetIconSize ImageList_Read ImageList_DragLeave ImageList_LoadImageW ImageList_Draw ImageList_Remove ImageList_ReplaceIcon ImageList_SetOverlayImage

ws2_32

WSAIoctl

shell32

Shell_NotifyIconW SHAppBarMessage

user32

CopyImage CreateWindowExW GetMenuItemInfoW SetMenuItemInfoW DefFrameProcW GetDCEx PeekMessageW MonitorFromWindow GetDlgCtrlID GetUpdateRect SetTimer MessageBoxA WindowFromPoint BeginPaint RegisterClipboardFormatW FrameRect MapVirtualKeyW IsWindowUnicode RegisterWindowMessageW FillRect GetMenuStringW DispatchMessageW CreateAcceleratorTableW SendMessageA DefMDIChildProcW EnumWindows GetClassInfoW ShowOwnedPopups GetSystemMenu GetScrollRange GetScrollPos SetScrollPos GetActiveWindow SetActiveWindow DrawEdge GetKeyboardLayoutList LoadBitmapW DrawFocusRect EnumChildWindows GetScrollBarInfo ReleaseCapture UnhookWindowsHookEx LoadCursorW GetCapture SetCapture CreatePopupMenu ScrollWindow ShowCaret GetMenuItemID GetLastActivePopup CharLowerBuffW GetSystemMetrics SetWindowLongW PostMessageW DrawMenuBar SetParent IsZoomed CharUpperBuffW GetClientRect IsChild ClientToScreen GetClipboardData SetClipboardData SetWindowPlacement IsIconic CallNextHookEx GetMonitorInfoW ShowWindow CheckMenuItem CharUpperW DefWindowProcW GetForegroundWindow SetForegroundWindow GetWindowTextW EnableWindow DestroyWindow IsDialogMessageW EndMenu RegisterClassW CharNextW GetWindowThreadProcessId RedrawWindow GetDC GetFocus SetFocus EndPaint ReleaseDC MsgWaitForMultipleObjectsEx LoadKeyboardLayoutW GetClassLongW ActivateKeyboardLayout GetParent DrawTextW SetScrollRange MonitorFromRect InsertMenuItemW PeekMessageA GetPropW SetClassLongW MessageBoxW MessageBeep SetPropW RemovePropW UpdateWindow GetSubMenu MsgWaitForMultipleObjects DestroyMenu DestroyIcon SetWindowsHookExW EmptyClipboard IsWindowVisible DispatchMessageA UnregisterClassW GetTopWindow SendMessageW AdjustWindowRectEx DrawIcon IsWindow EnumThreadWindows InvalidateRect GetKeyboardState DrawFrameControl ScreenToClient SetCursor CreateIcon CreateMenu LoadStringW CharLowerW SetWindowPos SetWindowRgn GetMenuItemCount RemoveMenu GetSysColorBrush GetKeyboardLayoutNameW GetWindowDC TranslateMessage OpenClipboard DrawTextExW MapWindowPoints EnumDisplayMonitors CallWindowProcW CloseClipboard DestroyCursor GetScrollInfo SetWindowTextW GetMessageExtraInfo EnableScrollBar GetSysColor TrackPopupMenu CopyIcon DrawIconEx PostQuitMessage GetClassNameW ShowScrollBar EnableMenuItem GetIconInfo GetMessagePos SetScrollInfo GetKeyNameTextW GetDesktopWindow GetCursorPos SetCursorPos HideCaret GetMenu GetMenuState SetMenu SetRect GetKeyState FindWindowExW MonitorFromPoint ValidateRect SystemParametersInfoW LoadIconW GetCursor GetWindow GetWindowLongW GetWindowRect InsertMenuW KillTimer WaitMessage IsWindowEnabled IsDialogMessageA TranslateMDISysAccel GetWindowPlacement CreateIconIndirect FindWindowW DeleteMenu GetKeyboardLayout

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

oleaut32

SafeArrayPutElement GetErrorInfo VariantInit VariantClear SysFreeString SafeArrayAccessData SysReAllocStringLen SafeArrayCreate SafeArrayGetElement SysAllocStringLen SafeArrayUnaccessData SafeArrayPtrOfIndex VariantCopy SafeArrayGetUBound SafeArrayGetLBound VariantCopyInd VariantChangeType

advapi32

RegSetValueExW RegConnectRegistryW RegEnumKeyExW RegLoadKeyW GetUserNameW RegDeleteKeyW RegOpenKeyExW RegQueryInfoKeyW RegUnLoadKeyW RegSaveKeyW RegDeleteValueW RegReplaceKeyW RegFlushKey RegQueryValueExW RegEnumValueW RegCloseKey RegCreateKeyExW RegRestoreKeyW

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

kernel32

SetFileAttributesW GetACP CloseHandle LocalFree GetCurrentProcessId SizeofResource GetSystemDefaultLangID QueryPerformanceFrequency IsDebuggerPresent VirtualFree GetFullPathNameW GetProcessHeap ExitProcess HeapAlloc GetCPInfoExW RtlUnwind GetCPInfo EnumSystemLocalesW GetStdHandle GetTimeZoneInformation GetModuleHandleW FreeLibrary TryEnterCriticalSection HeapDestroy ReadFile CreateProcessW GetLastError GetModuleFileNameW SetLastError GlobalAlloc GlobalUnlock FindResourceW CreateThread CompareStringW LoadLibraryA ResetEvent MulDiv FreeResource GetVersion RaiseException GlobalAddAtomW FormatMessageW SwitchToThread GetExitCodeThread GetCurrentThread LoadLibraryExW LockResource GetCurrentThreadId UnhandledExceptionFilter VirtualQuery GlobalFindAtomW VirtualQueryEx GlobalFree Sleep EnterCriticalSection SetFilePointer LoadResource SuspendThread GetTickCount GetFileSize GetStartupInfoW GlobalDeleteAtom GetFileAttributesW InitializeCriticalSection GetThreadPriority GetCurrentProcess SetThreadPriority GlobalLock VirtualAlloc GetCommandLineW GetSystemInfo GetTempPathW LeaveCriticalSection GetProcAddress ResumeThread GetVersionExW VerifyVersionInfoW HeapCreate LCMapStringW GetDiskFreeSpaceW VerSetConditionMask FindFirstFileW GetUserDefaultUILanguage lstrlenW QueryPerformanceCounter SetEndOfFile HeapFree WideCharToMultiByte FindClose MultiByteToWideChar LoadLibraryW SetEvent CreateFileW GetLocaleInfoW EnumResourceNamesW GetEnvironmentVariableW GetLocalTime WaitForSingleObject WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue SetErrorMode GetComputerNameW IsValidLocale TlsSetValue GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc CreateEventW WaitForMultipleObjectsEx SetThreadLocale GetThreadLocale

wsock32

gethostbyaddr WSACleanup gethostbyname bind gethostname closesocket WSAGetLastError connect inet_addr getpeername WSAAsyncSelect WSAAsyncGetServByName WSACancelAsyncRequest send ntohs htons WSAStartup getservbyname getsockname listen socket recv inet_ntoa ioctlsocket WSAAsyncGetHostByName

ole32

IsEqualGUID OleInitialize CLSIDFromProgID OleUninitialize CoInitialize CoCreateInstance CoUninitialize CoTaskMemFree CoTaskMemAlloc

gdi32

Pie SetBkMode CreateCompatibleBitmap GetEnhMetaFileHeader RectVisible AngleArc SetAbortProc SetTextColor StretchBlt RoundRect RestoreDC SetRectRgn GetTextMetricsW GetWindowOrgEx CreatePalette PolyBezierTo CreateICW CreateDCW GetStockObject CreateSolidBrush Polygon MoveToEx PlayEnhMetaFile Ellipse StartPage GetBitmapBits StartDocW AbortDoc GetSystemPaletteEntries GetEnhMetaFileBits GetEnhMetaFilePaletteEntries CreatePenIndirect CreateFontIndirectW PolyBezier EndDoc GetObjectW GetWinMetaFileBits SetROP2 GetEnhMetaFileDescriptionW ArcTo Arc SelectPalette ExcludeClipRect MaskBlt SetWindowOrgEx EndPage DeleteEnhMetaFile Chord SetDIBits SetViewportOrgEx CreateRectRgn RealizePalette SetDIBColorTable GetDIBColorTable CreateBrushIndirect PatBlt SetEnhMetaFileBits Rectangle SaveDC DeleteDC FrameRgn BitBlt GetDeviceCaps GetTextExtentPoint32W GetClipBox IntersectClipRect Polyline CreateBitmap SetWinMetaFileBits CombineRgn GetStretchBltMode CreateDIBitmap SetStretchBltMode GetDIBits CreateDIBSection LineTo GetRgnBox EnumFontsW CreateHalftonePalette SelectObject DeleteObject ExtFloodFill UnrealizeObject CopyEnhMetaFileW SetBkColor CreateCompatibleDC GetBrushOrgEx GetCurrentPositionEx GetTextExtentPointW ExtTextOutW SetBrushOrgEx GetPixel GdiFlush SetPixel EnumFontFamiliesExW StretchDIBits GetPaletteEntries

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

28KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

122B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

88B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

93B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7WZ5e37Gka9w1q290601ONqR677ziM15.exe

winspool.drv

comctl32

ws2_32

shell32

user32

version

oleaut32

advapi32

wtsapi32

kernel32

wsock32

ole32

gdi32

generic