cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f

Sharing

Copy URL Twitter E-mail

General

Target
cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f
Size 3.1MB
Sample261003-yb2b6afb44
SHA256 cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f
MD5 ff4e5f51f8a928e16165177bcc557eb6
SHA1 2fbbab5babb4ec2c3414f1c557f6938a60805b28
SHA512 489b2d155d3fad413428caf26867e9e270f803500e66c0cc96af64d4ac94c8c8710da62304fb278ead56e8d772751b3204efdf44b7b614fc4b577c00d016754a
SSDEEP 49152:afGMz4QboA7aB2oWQzMoBR/BGKI6OXeJ1JJpJppzMhKshRtYZq7l9TPqd:kcQ/GzMoHBGKI6OXe7JLlALm
TLSH
T115E52215E2A800F9E167D678CE935902F67638474731A7CB03A4EAB61F273D49A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f

File Explorer

cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f

.exe 3.1MB

cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f

IMPHASH 87147e0aa3a00fca973bcaf30928b0ce
SHA256 cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f
MD5 ff4e5f51f8a928e16165177bcc557eb6
SHA1 2fbbab5babb4ec2c3414f1c557f6938a60805b28
SHA512 489b2d155d3fad413428caf26867e9e270f803500e66c0cc96af64d4ac94c8c8710da62304fb278ead56e8d772751b3204efdf44b7b614fc4b577c00d016754a
SSDEEP 49152:afGMz4QboA7aB2oWQzMoBR/BGKI6OXeJ1JJpJppzMhKshRtYZq7l9TPqd:kcQ/GzMoHBGKI6OXe7JLlALm
TLSH
T115E52215E2A800F9E167D678CE935902F67638474731A7CB03A4EAB61F273D49A3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

169888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

RegisterHotKey UnregisterHotKey PeekMessageW DispatchMessageW TranslateMessage SendMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW IsChild DestroyWindow ShowWindow MoveWindow SetWindowPos IsIconic OpenClipboard CloseClipboard SetClipboardData EmptyClipboard SetTimer KillTimer EnableWindow GetSystemMetrics UpdateWindow GetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint InvalidateRect SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW SetCursor ScreenToClient WindowFromPoint FillRect SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx LoadCursorW LoadIconW IsDialogMessageW GetMessageW SystemParametersInfoW SetProcessDPIAware PostMessageW

gdi32

GdiFlush SetBrushOrgEx CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetBkColor SelectObject DeleteObject DeleteDC CreateSolidBrush CreateFontW CreateCompatibleDC BitBlt

bcrypt

BCryptHash

gdiplus

GdipCloneBrush GdipAddPathArc GdipClosePathFigure GdipDeletePath GdipCreateSolidFill GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreatePen1 GdipCreatePath GdipCreateLineBrush GdipDeletePen GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipGetImageGraphicsContext GdipGetImageWidth GdipGetImageHeight GdipCreateBitmapFromStream GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipCreateBitmapFromHBITMAP GdipBitmapLockBits GdipBitmapUnlockBits GdipFlush GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipSetInterpolationMode GdipScaleWorldTransform GdipDrawLineI GdipDrawRectangle GdipDrawRectangleI GdipGraphicsClear GdipFillRectangle GdipFillRectangleI GdipFillEllipse GdipFillPath GdipDrawImageRect GdipDrawImageRectI GdipDrawImageRectRect GdipSaveGraphics GdipRestoreGraphics GdipGetImageEncodersSize GdipGetImageEncoders GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipDeleteBrush

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal

kernel32

IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetOEMCP HeapReAlloc GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW GetACP GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetFileInformationByHandleEx MoveFileExW CopyFile2 GetProcAddress AreFileApisANSI CreateFile2 SetFileTime SetFileInformationByHandle GetFinalPathNameByHandleW GetFileInformationByHandle GetFileAttributesExW SetEndOfFile FindResourceW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocalTime GetTickCount64 GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource RtlUnwind GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetSystemTimePreciseAsFileTime LocalFree FormatMessageA GetLocaleInfoEx CloseHandle GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread

Name

.text

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cdd6b84b2ef918c88a350d9d0697db85691fe37a281ea9adb1c796cbd3e6485f

user32

gdi32

bcrypt

gdiplus

comdlg32

shell32

ole32

kernel32

generic