ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08

Sharing

Copy URL Twitter E-mail

General

Target
ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08
Size 5.7MB
Sample261003-yb29fsfb46
SHA256 ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08
MD5 81c715ab47a98fc9bb0fd5ce39697cef
SHA1 72e4ceb84d812d121a297fb8d50184e542688734
SHA512 dfa23a3000feb52b074cadeb7b586caba2e0f0f545cd60640e5d1a26d6e8676e34492ce557867623cd8b8c948caa326d5b6c27baaa0ac23271689ff9530a802b
SSDEEP 98304:B3nTfJTl6TC8e8+pDnapSKd0GATW4N4AO0SSXIwKLzTN8JUJ3btlD:BjhTlz8e86napSgKDN4AO0SS4N5bJ3P
TLSH
T1DB56DF6666B820F9C567D2789812950BF571343A03E4EBEB23D70E271E57EE40E7E780
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08

File Explorer

ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08

.exe 5.7MB

ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08

IMPHASH 3c349cf8dc08d21e2b7187f46d3c04b6
SHA256 ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08
MD5 81c715ab47a98fc9bb0fd5ce39697cef
SHA1 72e4ceb84d812d121a297fb8d50184e542688734
SHA512 dfa23a3000feb52b074cadeb7b586caba2e0f0f545cd60640e5d1a26d6e8676e34492ce557867623cd8b8c948caa326d5b6c27baaa0ac23271689ff9530a802b
SSDEEP 98304:B3nTfJTl6TC8e8+pDnapSKd0GATW4N4AO0SSXIwKLzTN8JUJ3btlD:BjhTlz8e86napSgKDN4AO0SS4N5bJ3P
TLSH
T1DB56DF6666B820F9C567D2789812950BF571343A03E4EBEB23D70E271E57EE40E7E780
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1455612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW FreeLibrary SetFilePointer LocalFileTimeToFileTime GetLastError GetCurrentDirectoryW WideCharToMultiByte LocalAlloc UnmapViewOfFile CreateFileMappingA OpenFileMappingA MapViewOfFile HeapFree SetPriorityClass GetCurrentProcess VirtualAlloc SetThreadPriority InitializeCriticalSectionEx GetEnvironmentVariableA GetModuleHandleA GetExitCodeThread GetTickCount64 Process32NextW GlobalSize GetCurrentThread GetSystemDirectoryA K32GetModuleBaseNameA RaiseException HeapAlloc DecodePointer GlobalLock DeleteCriticalSection ExitProcess GetCurrentProcessId GetProcessHeap GetModuleHandleW K32EnumProcessModules VerifyVersionInfoW GlobalUnlock VirtualQuery GetComputerNameA GetCurrentThreadId GetFullPathNameA SetEnvironmentVariableA CreateMutexA SizeofResource GetFileSizeEx CreateFile2 FreeResource HeapSize Sleep GetTempPathA LockResource HeapReAlloc CreateThread LoadResource FindResourceW CreateFileMappingFromApp MapViewOfFileFromApp GetModuleFileNameA SetLastError FormatMessageW EnterCriticalSection LeaveCriticalSection SleepEx QueryPerformanceFrequency GetSystemDirectoryW QueryPerformanceCounter GetTickCount MoveFileExW WaitForSingleObjectEx GetStdHandle GetFileType ReadFile WaitForMultipleObjects FindClose FindNextFileW TryEnterCriticalSection InitializeSRWLock GetNativeSystemInfo VerSetConditionMask GetWindowsDirectoryA CloseHandle MultiByteToWideChar WaitForSingleObject GetVolumeInformationA PeekNamedPipe GetStartupInfoW GetSystemFirmwareTable GetProcAddress LoadLibraryA WriteConsoleW InitOnceBeginInitialize RtlUnwind InitOnceComplete SleepConditionVariableSRW DeleteFileW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetStringTypeW AcquireSRWLockShared AcquireSRWLockExclusive FindFirstFileExW SetEndOfFile GetFullPathNameW GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetModuleFileNameW GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode CreateDirectoryW ReleaseSRWLockShared SetEnvironmentVariableW SetFilePointerEx GetFileAttributesExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW CreateFileW FreeLibraryAndExitThread ExitThread SetStdHandle GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx OutputDebugStringW GetCPInfo CompareStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead ReleaseSRWLockExclusive

user32

MessageBoxA

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW OpenProcessToken SetSecurityDescriptorDacl AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor

shell32

SHGetFolderPathA

ole32

CoInitializeSecurity CoSetProxyBlanket CreateStreamOnHGlobal CoCreateInstance CoUninitialize GetHGlobalFromStream CoInitializeEx

oleaut32

SafeArrayCreate VariantClear SysAllocString SafeArrayPutElement VariantInit SysFreeString

shlwapi

PathRemoveFileSpecA

ws2_32

getnameinfo setsockopt WSACleanup bind closesocket getaddrinfo WSAStartup getsockname socket ntohs gethostname htonl inet_ntop freeaddrinfo htons recv ioctlsocket sendto recvfrom accept __WSAFDIsSet WSAIoctl WSASetLastError WSACloseEvent getsockopt connect WSAGetLastError WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent select shutdown listen WSAAccept WSASocketW getpeername send

wldap32

ord301 ord219 ord46 ord14 ord216 ord208 ord41 ord117 ord26 ord27 ord127 ord167 ord142 ord79 ord133 ord147 ord145

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlPcToFileHeader

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

339KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fOO

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ab4bc58cdb65a4b3596dc47f7e457ed5ea5601276d536b7476cdc76491b0cf08

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

wldap32

gdiplus

ntdll

generic