6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519

Sharing

Copy URL Twitter E-mail

General

Target
6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519
Size 607KB
Sample261006-qw2vesfb39
SHA256 6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519
MD5 da201a2f73fa79c4d7e17782c054db9e
SHA1 55b1c68973d2256d5f0b8d6097370d8d01a71ad4
SHA512 ed3ca4c54d3ce40d42b7eafa3c37a84668d3e1b38fcd1b4ced137abcd01d1585a4a0f5499de866295aadac17bf99e68a7b8b68c7db7fe70149328d72534b3944
SSDEEP 3072:8kFt3VizzWbWKTKjAzcq3IqdcsAghV0ezVRxaz0bNIESdtBw46frHB9KXTnGQOpK:zn3V5FYoc4wrYsBLm0Tp
TLSH
T1E7D4D69072E0A893F177833948E7D2213B39BB5157ABCF0BDA04A91C0927BD36ED5752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519

File Explorer

6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519

.dll 607KB

6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519

IMPHASH 85cac74e8311a99a39a53bda73040447
SHA256 6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519
MD5 da201a2f73fa79c4d7e17782c054db9e
SHA1 55b1c68973d2256d5f0b8d6097370d8d01a71ad4
SHA512 ed3ca4c54d3ce40d42b7eafa3c37a84668d3e1b38fcd1b4ced137abcd01d1585a4a0f5499de866295aadac17bf99e68a7b8b68c7db7fe70149328d72534b3944
SSDEEP 3072:8kFt3VizzWbWKTKjAzcq3IqdcsAghV0ezVRxaz0bNIESdtBw46frHB9KXTnGQOpK:zn3V5FYoc4wrYsBLm0Tp
TLSH
T1E7D4D69072E0A893F177833948E7D2213B39BB5157ABCF0BDA04A91C0927BD36ED5752
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueW

comctl32

PropertySheetW

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear VariantCopy VariantChangeType SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement VarI2FromUI1 VarI2FromI4 VarI2FromR4 VarI2FromR8 VarI2FromCy VarI2FromDate VarI2FromStr VarI2FromBool VarI4FromUI1 VarI4FromI2 VarI4FromR4 VarI4FromR8 VarI4FromCy VarI4FromDate VarI4FromStr VarI4FromBool VarR4FromUI1 VarR4FromI2 VarR4FromI4 VarR4FromR8 VarR4FromCy VarR4FromDate VarR4FromStr VarR4FromBool VarR8FromUI1 VarR8FromI2 VarR8FromI4 VarR8FromR4 VarR8FromCy VarR8FromDate VarR8FromStr VarR8FromBool VarDateFromUI1 VarDateFromI2 VarDateFromI4 VarDateFromR4 VarDateFromR8 VarDateFromCy VarDateFromStr VarDateFromBool VarCyFromUI1 VarCyFromI2 VarCyFromI4 VarCyFromR4 VarCyFromR8 VarCyFromDate VarCyFromStr VarCyFromBool VarBstrFromUI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarBstrFromCy VarBstrFromDate VarBstrFromBool VarBoolFromUI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromR4 VarBoolFromR8 VarBoolFromDate VarBoolFromCy VarBoolFromStr VarUI1FromI2 VarUI1FromI4 VarUI1FromR4 VarUI1FromR8 VarUI1FromCy VarUI1FromDate VarUI1FromStr VarUI1FromBool SystemTimeToVariantTime VariantTimeToSystemTime VarI2FromI1 VarI2FromUI2 VarI2FromUI4 VarI2FromDec VarI4FromI1 VarI4FromUI2 VarI4FromUI4 VarI4FromDec VarR4FromI1 VarR4FromUI2 VarR4FromUI4 VarR4FromDec VarR8FromI1 VarR8FromUI2 VarR8FromUI4 VarR8FromDec VarDateFromI1 VarDateFromUI2 VarDateFromUI4 VarDateFromDec VarCyFromI1 VarCyFromUI2 VarCyFromUI4 VarCyFromDec VarBstrFromI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromDec VarBoolFromI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromDec VarUI1FromI1 VarUI1FromUI2 VarUI1FromUI4 VarUI1FromDec VarI1FromUI1 VarI1FromI2 VarI1FromI4 VarI1FromR4 VarI1FromR8 VarI1FromDate VarI1FromCy VarI1FromStr VarI1FromBool VarI1FromUI2 VarI1FromUI4 VarI1FromDec VarUI2FromUI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromR4 VarUI2FromR8 VarUI2FromDate VarUI2FromCy VarUI2FromStr VarUI2FromBool VarUI2FromI1 VarUI2FromUI4 VarUI2FromDec VarUI4FromUI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromR4 VarUI4FromR8 VarUI4FromDate VarUI4FromCy VarUI4FromStr VarUI4FromBool VarUI4FromI1 VarUI4FromUI2 VarUI4FromDec VarI8FromStr VarI2FromI8 VarI2FromUI8 VarI4FromI8 VarI4FromUI8 VarR4FromI8 VarR4FromUI8 VarR8FromI8 VarR8FromUI8 VarDateFromI8 VarDateFromUI8 VarCyFromI8 VarCyFromUI8 VarBstrFromI8 VarBstrFromUI8 VarBoolFromI8 VarBoolFromUI8 VarUI1FromI8 VarUI1FromUI8 VarDecFromI8 VarI1FromI8 VarI1FromUI8 VarUI2FromI8 VarUI2FromUI8 VarUI4FromI8 VarUI4FromUI8 VarUI8FromI8 VarUI8FromUI1 VarUI8FromI2 VarUI8FromR4 VarUI8FromR8 VarUI8FromCy VarUI8FromDate VarUI8FromStr VarUI8FromBool VarUI8FromI1 VarUI8FromUI2 VarUI8FromUI4 VarUI8FromDec

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _strdup _wcsdup _wcsicmp bsearch calloc free fwrite getenv iswspace malloc memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen wcscat wcschr wcscpy wcsstr

user32

CharLowerW EnableWindow GetDlgItem GetParent GetWindowRect LoadStringW MessageBoxA MessageBoxW SendMessageA SendMessageW SetWindowLongW wsprintfW

Name

.text

Size

68KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

64KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

116KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6427ae6d721901b1bc307159cd48d6114f89072d435aa4b9609b8abaf7f51519

advapi32

comctl32

kernel32

ntdll

ole32

oleaut32

ucrtbase

user32

generic