229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78

Sharing

Copy URL Twitter E-mail

General

Target
229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78
Size 3.4MB
Sample261011-e8vq4ae16z
SHA256 229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78
MD5 f1046cdb2a18c754540251bece410959
SHA1 0834d2a5ccbb90ef38e1abd83eac4d748b73fa50
SHA512 a501ae8bf30e33acca0239cfa0a484cd9ac6a83c19cc3523df502b5f8c1bca18dcb58dc761d3d3cbb66b684cb449db540b28418174b678b3528e0bd93bb71d8c
SSDEEP 49152:5Xp7iQ4AJ2hXgzSeiUkDW5vj2GjZuC7hBUhSOiPzIh+iyoXD4qUy7wQQvhx96S7H:3irHbeiUWW5vhhB4isJHUj9XMc
TLSH
T192F56B11E24290A2D68105F1DD56FAFB97687F3447F691E7F2C02BEBAB202C17932917
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78

File Explorer

229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78

.exe 3.4MB

229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78

IMPHASH 1ab598bf1b04c7500f70ecc8496a5653
SHA256 229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78
MD5 f1046cdb2a18c754540251bece410959
SHA1 0834d2a5ccbb90ef38e1abd83eac4d748b73fa50
SHA512 a501ae8bf30e33acca0239cfa0a484cd9ac6a83c19cc3523df502b5f8c1bca18dcb58dc761d3d3cbb66b684cb449db540b28418174b678b3528e0bd93bb71d8c
SSDEEP 49152:5Xp7iQ4AJ2hXgzSeiUkDW5vj2GjZuC7hBUhSOiPzIh+iyoXD4qUy7wQQvhx96S7H:3irHbeiUWW5vhhB4isJHUj9XMc
TLSH
T192F56B11E24290A2D68105F1DD56FAFB97687F3447F691E7F2C02BEBAB202C17932917
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2856480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

mixerOpen mixerGetDevCapsA timeEndPeriod timeBeginPeriod timeGetTime PlaySoundA mixerSetControlDetails mixerGetControlDetailsA mixerGetLineControlsA mixerGetLineInfoA mixerClose

ws2_32

ioctlsocket getsockopt htons listen ntohl recv select send setsockopt socket gethostname connect WSACleanup WSAGetLastError accept bind getaddrinfo closesocket gethostbyname inet_addr __WSAFDIsSet WSAStartup freeaddrinfo

kernel32

AcquireSRWLockExclusive GetTickCount GetFileAttributesW MulDiv MultiByteToWideChar GetACP CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject Sleep GetCurrentProcessId MapViewOfFile CreateFileMappingA QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable GetFileAttributesExA GetEnvironmentVariableA IsDebuggerPresent OutputDebugStringA RaiseException SetUnhandledExceptionFilter FreeLibrary GetProcAddress LoadLibraryA CreateFileA GetFileTime GetSystemDirectoryA FileTimeToSystemTime VirtualQuery GetModuleFileNameA GetCurrentThread SetThreadPriority FindClose FindFirstFileA SetErrorMode GetCurrentProcess GetCurrentThreadId GetVersionExA IsBadWritePtr FindNextFileA GetFileSize DeleteFileA GetWindowsDirectoryA GetCommandLineA GetLastError CreateMutexA GetModuleHandleA GlobalAlloc GlobalUnlock GlobalLock GlobalFree FileTimeToLocalFileTime SleepConditionVariableSRW UnhandledExceptionFilter ReleaseSRWLockExclusive TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte HeapAlloc HeapFree CompareFileTime GetProcessHeap

user32

ChangeDisplaySettingsA DestroyCursor CreateCursor EnumWindows SetWindowLongA GetWindowLongA WindowFromPoint ScreenToClient GetCursorPos EnumDisplaySettingsA EndPaint BeginPaint SetForegroundWindow ReleaseCapture SetCapture EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetDlgItem SystemParametersInfoA GetWindowRect SendMessageA GetDC EndDialog DialogBoxIndirectParamA IsIconic IsWindowVisible GetWindowPlacement DefWindowProcW PostMessageA PeekMessageA RegisterWindowMessageA LoadIconA LoadCursorA GetSysColorBrush SetCursor MessageBoxW AdjustWindowRect GetWindowTextA SetWindowTextA SetTimer SetFocus ShowWindow DestroyWindow CreateWindowExW CreateWindowExA RegisterClassA DefWindowProcA FillRect DispatchMessageA TranslateMessage GetMessageA SetCaretPos ShowCaret HideCaret DestroyCaret CreateCaret DrawTextExA GetWindowInfo OffsetRect AdjustWindowRectEx GetSystemMetrics MoveWindow ClientToScreen GetClientRect MessageBoxA GetActiveWindow ReleaseDC

gdi32

GetTextExtentPoint32A CreateCompatibleDC TextOutA GetTextMetricsA CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextExtentPoint32W IntersectClipRect SelectObject SetBkMode SetTextColor GetTextMetricsW CreateDIBSection TextOutW GetObjectA CreateFontIndirectA CreateFontA

shell32

ShellExecuteA

ole32

CoInitialize

advapi32

RegOpenKeyExA RegOpenKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegCreateKeyExA

msvcp140

?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?eof@ios_base@std@@QBE_NXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?always_noconv@codecvt_base@std@@QBE_NXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QBE_NXZ ?flags@ios_base@std@@QBEHXZ ?width@ios_base@std@@QBE_JXZ ?width@ios_base@std@@QAE_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?_Xbad_alloc@std@@YAXXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z

vcruntime140

memcmp __RTDynamicCast memchr memset memmove memcpy __CxxFrameHandler3 _CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate __vcrt_LoadLibraryExW __vcrt_GetModuleFileNameW _except_handler4_common __current_exception_context __current_exception strchr _setjmp3 longjmp strrchr strstr _purecall

api-ms-win-crt-runtime-l1-1-0

_cexit _beginthread _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe _set_app_type _get_narrow_winmain_command_line _initterm _initterm_e _exit _errno _c_exit _register_thread_local_exe_atexit_callback _controlfp_s _invoke_watson abort exit terminate strerror _beginthreadex

api-ms-win-crt-time-l1-1-0

_localtime64_s asctime _localtime64 _strtime _time64 _gmtime64

api-ms-win-crt-math-l1-1-0

_libm_sse2_pow_precise _CIfmod frexp floor pow _libm_sse2_cos_precise _libm_sse2_sin_precise ceil modf __setusermatherr _CIatan2 _libm_sse2_sqrt_precise _libm_sse2_log10_precise

api-ms-win-crt-convert-l1-1-0

atof wcstombs atoi

api-ms-win-crt-string-l1-1-0

strncpy isspace strlen strtok strcpy_s strcat_s _strnicmp strncpy_s iswspace strncmp isalnum isdigit toupper _strupr isalpha strspn tolower _stricmp wcscpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf ftell _getcwd fseek ferror __p__commode __stdio_common_vsnprintf_s fwrite fread __acrt_iob_func ungetc setvbuf _fseeki64 fsetpos fputc fgetpos _get_stream_buffer_pointers fgetc fflush __stdio_common_vfprintf __stdio_common_vfscanf fputs fgets feof fclose fopen __stdio_common_vsprintf_s _set_fmode __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

free realloc calloc malloc _set_new_mode _callnewh

api-ms-win-crt-utility-l1-1-0

srand qsort rand abs

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file _rmdir _chdir _mkdir remove

api-ms-win-crt-environment-l1-1-0

getenv_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

229c5426dbf209c90d0b6f05453e1860f4412f46cf41b287bd06a48703553c78

winmm

ws2_32

kernel32

user32

gdi32

shell32

ole32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic