Un_A - Copia[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Un_A - Copia.exe
Size 74KB
Sample261009-tgn7kaca45
SHA256 f5bc4dd91bf120bc75e9e3c13afdbdadde153da511dc218a36373d62e73985c3
MD5 75ee17e64d015ea1374ab8a00300e672
SHA1 845aa10e7906aa9b6b7d3be370bcf762aed66d9e
SHA512 ee8cfbd22a7a91f4428d8a2676a9fe291011ef936eee7f7ad081ceb94582352867df4a2329c66109984267a180b10f7c9e50c85ccdbdc9ad56183480c02b8370
SSDEEP 1536:2o/y3BObkRlV3aLrq6fuqJiKmLfQKTv2OxHQGLrH:Fa34u3Yq6fuemLI02Oxw2D
TLSH
T1CE73AF1033A8C52BCA6206700D36A67756F9AAA938B6535F73107B5D3B71781FE2F381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
Un_A - Copia.exe
unpack001/$PLUGINSDIR/EnVar.dll
unpack001/$PLUGINSDIR/InstallOptions.dll

File Explorer

Un_A - Copia.exe

.exe 74KB
$PLUGINSDIR/EnVar.dll

.dll 9KB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB

Un_A - Copia.exe

IMPHASH 24f4223e271413c25abad52fd456a9bc
SHA256 f5bc4dd91bf120bc75e9e3c13afdbdadde153da511dc218a36373d62e73985c3
MD5 75ee17e64d015ea1374ab8a00300e672
SHA1 845aa10e7906aa9b6b7d3be370bcf762aed66d9e
SHA512 ee8cfbd22a7a91f4428d8a2676a9fe291011ef936eee7f7ad081ceb94582352867df4a2329c66109984267a180b10f7c9e50c85ccdbdc9ad56183480c02b8370
SSDEEP 1536:2o/y3BObkRlV3aLrq6fuqJiKmLfQKTv2OxHQGLrH:Fa34u3Yq6fuemLI02Oxw2D
TLSH
T1CE73AF1033A8C52BCA6206700D36A67756F9AAA938B6535F73107B5D3B71781FE2F381
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ExitProcess SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess SetCurrentDirectoryW GetFileAttributesW SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW CopyFileW MoveFileW GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalUnlock GetDiskFreeSpaceW GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/EnVar.dll

IMPHASH 036a4a38ad933916e2a624590ca9397c
SHA256 476f809c48b84e5d8eb3f5be1310128e5d50109ea3a26b10e987024877e20a9d
MD5 41dcb470b4e9fa08e0598112977f3092
SHA1 ea9e57bdc6193974e6a7be92d682f247250a68c4
SHA512 700b1c2de797bbc3dcb2e08a414f272e36d3634613d1a828347bc80dac553293f7ed8ca7d6f83e2a261908d05e93b53b0a134a10eaa5cb0e06f1972a6ccc632e
SSDEEP 96:8OKG2vte13cu9ahfSTsbm7fkRpOQcXzQyOFiRQcigci7ciWciici/NWp:TKTe13cQa+2mqpcXtIQDNo
TLSH
T11B12A6018698C2B6F5B962FD85BB48AFA079FDB043074EC701A7309A16516C97D3B3B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Programs\nsis\EnVar\Release Unicode\EnVar.pdb

$PLUGINSDIR/InstallOptions.dll

IMPHASH 4b45b7e00344a87332fbd12653854d1a
SHA256 caf64a4e9449220ba618a9aa2ae4ed3774c5d0f193bda44be22676c27ae0ec95
MD5 09d8971beefefffd710030dd167a99e0
SHA1 a0117786ad77213f3eb48cfdc3819786cb796b7d
SHA512 3956f0c6bcdf033e4a10ab33872a66e0668da28ec31cb7a2c67ef7266d7c0845998a2a85a6cc25aba1df73909df8104119cf5f1f86c1e91f8fd201765aea49f0
SSDEEP 384:EhC43tPegZ3eBaRwCPOYY7nNYXC8/Yosa:EoTgZ3eBTCmrnNAI
TLSH
T19C624C1137D558B3E2D62A797EE2B7138FA5F722A4438E0BC7332E06281A5956E7C311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile SetCurrentDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc WriteFile SetFilePointer

user32

LoadCursorW SetWindowRgn GetDlgCtrlID CloseClipboard DrawFocusRect OpenClipboard DrawTextW SetCursor LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW GetClientRect ShowWindow GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW GetWindowLongW EnableMenuItem PtInRect MapWindowPoints GetClipboardData

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectW

shell32

SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

Un_A - Copia.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/EnVar.dll

shlwapi

kernel32

user32

advapi32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic